Centrally Manager Users (CMU) Password Based Auth password sync

I'm interested in CMU. Reading the here setup guide it indicates that if password based authentication is to be used you must extend the schema so it can add the attribute <i>orclCommonAttribute</i> and also a password filter on the Domain Controllers. This seems to indicate that when the password is set in AD it is synchronised back to the Oracle Database. This seems odd to me as I assumed that in this pattern Oracle simply handed off to AD to do the auth. Schema extensions and password filters always make our IT Sec people nervous.