by David Perry.
+1 for the above (Google Apps Directory Sync). I had some weird problems getting it to work, but got there eventually (one of which was our network being overzealous at the proxy level when I was trying to 'authorise' GADS to work with our google domain). Also, what they don't tell you properly, is that when you're authorising it, you need to be logged in to the browser as your google domain's admin user, eg admin@yourdomain (we setup Shibboleth SSO into google).