powertower
I used this script for authentication and created my own script for access permissions based on Active Directory groups.
If you check out the LDAP User Source you will find the following options:
- Map User Groups (this should be memberOf for AD)
- Map Group Members (this should be member for AD)
- Use Reverse Group Membership - this when enabled will look at the groups in the group map to find the members of the group; I don't think this is presently compatible with recursive group membership
- Authenticate Group Search - This is required to be enabled for AD
- Use Recursive Group Membership - This works back through the tree to find the group memberships for the user which can then be applied to the group map
I think you've replicated the functionality of the last option but I'm not entirely sure.

