I can successfully bind to the ldap server, and I have set up authentication successfully - ldap users can log in to my open atrium site. However, the authorization mappings for the groups aren't coming through.
I have this as a mapping under: admin/config/people/ldap/authorization/edit/og_group
CN=Human Resources,OU=Groups,OU=Domain Users,OU=Domain Controllers,DC=domainname,DC=com|node:100:6
Where "100" is the node id for the open atrium space (og group), and "6" is a custom group admin role with a set of permissions defined in: admin/config/group/roles/node/oa_space
However, when I log in with a user that is confirmed to have this "memberof" attribute in active directory, the user does not have the corresponding access to the organic group.
I have tried both "Convert full dn to value of first attribute before mapping" checked and unchecked with the same results.
The mapping is shown to be enabled here: admin/config/people/ldap/authorization
I'm finding the documentation a little lax here. Am I mapping the correct og role id? Does the og role id translate to the role id in admin/config/group/roles/node/oa_space? Is this set somewhere else? Where? Is there anything else I have to do to bring these mappings over?