You will probably need three tables:
User tables with a primary key and the usual first name, last name etc
Roles table with roles specific to your application (eg Administrator, Power User, User, read only)
UserRoles with the user primary key, roles primary key, date created, date last modified, enabled (NUMBER (1) default 1 with check constraint that this field can only have the values of 0 or 1
As you indicated you will also need a package/procedure to query Active Directory for the users who have roles that are of interest to your application. The usual insert/update methods are required. Keep in mind that you never want to delete a user for an intranet application if there is any logging so when someone leaves the user table is updated to indicate that enabled = 0.
You indicate that you are using SQL server, that makes it easier than some other databases. A query such as this will get you started:
SELECT * FROM OpenQuery ( ADSI, 'SELECT displayName,
telephoneNumber, mail, mobile, facsimileTelephoneNumber FROM
''LDAP://DOMAIN.com/OU=Players,DC=DOMAIN,DC=com'' WHERE objectClass
= ''User'' ') AS tblADSI ORDORDER BY displayname
Keep in mind that there are many fields in Active Directory. The less you ask for the better. Depending on how you access AD you may find a record limitation of no more than 1000 records can be returned.
Fields that you mention such as "annual leave count, hire date, sick leave count" should be in separate tables as the functionality is not connected to Active Directory
I don't know of any other practical way aside from a sync job. Your system and AD are separate and you do not want to tie the two together closely. Most AD data is best described as "Slowly changing" so a sync job on five minute intervals works for many applications.
1) You asked if this is valid approach to:
2) what do you mean by " Your system and AD are separate and you do not want to tie the two together closely"
- you want to minimize the points of failure. Your system should work when the sync process is not working due to unexpected failure. Active Directory should work if your sync procedure fails.