LDAP Authorization: II.C. Need support for groupOfUniqueNames objectClass

Anything that will help with usability of this is part of ldap authorization is greatly appreciated. Is this issue about tweaking the wording and functionality of option II.C. in ldap authorization (admin/config/people/ldap/authorization/edit/drupal_role) or another mapping approach? I'm upping this to major because it seems critical to anyone using ldap authorization with an ldap structured this way.

Here is the simpletest for II.C.

  function testDeriveFromEntry() {
    $test_id = 'DeriveFromEntry';
    $conf_id = 'DeriveFromEntry';
    $consumer_conf_admin = $this->prepTestData($conf_id);

    /**
     * test:  DeriveFromEntry.nomatch no matches on dn attribute.
     *
     * should not match any mappings
     */

    $user = $this->drupalCreateUser(array());
    $unkool = $this->testFunctions->drupalLdapUpdateUser(array('name' => 'unkool', 'mail' =>  'unkool@nowhere.myuniversity.edu'), TRUE, $user);
    list($new_authorizations, $notifications) = ldap_authorizations_user_authorizations($unkool, 'query');  // just see if the correct ones are derived.
    $this->assertTrue(count($new_authorizations) == 0, 'user account unkool tested for granting no drupal roles ', $test_id . '.nomatch');


    /**
     * test:  DeriveFromEntry.onematch  matches on one dn attribute.
     *
     */

    $user = $this->drupalCreateUser(array());
    $jkool = $this->testFunctions->drupalLdapUpdateUser(array('name' => 'jkool', 'mail' =>  'jkool@guests.myuniversity.edu'), TRUE, $user);
    list($new_authorizations, $notifications) = ldap_authorizations_user_authorizations($jkool, 'query');  // just see if the correct ones are derived.
    $correct_roles = (bool)(isset($new_authorizations['drupal_role']) && in_array('content editors', $new_authorizations['drupal_role']));
    $this->assertTrue($correct_roles, 'user account jkool tested for granting drupal_role "content editors"', $test_id . '.onematch');


    /**
     * test:  DeriveFromEntry.manymatch many matches on dn attribute.
     */

    $user = $this->drupalCreateUser(array());
    $verykool = $this->testFunctions->drupalLdapUpdateUser(array('name' => 'verykool', 'mail' =>  'verykool@myuniversity.edu'), TRUE, $user);
    list($new_authorizations, $notifications) = ldap_authorizations_user_authorizations($verykool, 'query');  // just see if the correct ones are derived.
    $correct_roles = (bool)(isset($new_authorizations['drupal_role']) &&
      in_array('content editors', $new_authorizations['drupal_role']) &&
      in_array('content approvers', $new_authorizations['drupal_role'])
      );
    $this->assertTrue($correct_roles, 'user account verykool tested for granting "content editors" and "content approvers" drupal roles ', $test_id . '.manymatch');

    $delete_result = $this->removeTestData($conf_id);

  }

Where the test data is:

$test_data['server']['users']['cn=jkool,ou=guest accounts,dc=ad,dc=myuniveristy,dc=edu']['attr'] = array(
    'dn' => 'cn=jkool,ou=guest accounts,dc=ad,dc=myuniveristy,dc=edu',
    'mail' => array( 0 => 'jkool@guests.myuniversity.edu', 'count' => 1),
    'sAMAccountName' => array( 0 => 'jkool', 'count' => 1),
    'password' => array( 0 => 'goodpwd', 'count' => 1),
    'memberOf' => array( 0 => 'cn=sysadmins,ou=it,dc=ad,dc=myuniveristy,dc=edu', 'count' => 1),
  );

$test_data['server']['users']['cn=unkool,ou=lost,dc=ad,dc=myuniveristy,dc=edu']['attr'] = array(
    'dn' => 'cn=unkool,ou=lost,dc=ad,dc=myuniveristy,dc=edu',
    'mail' => array( 0 => 'unkool@nowhere.myuniversity.edu', 'count' => 1),
    'sAMAccountName' => array( 0 => 'jkool', 'count' => 1),
    'password' => array( 0 => 'goodpwd', 'count' => 1),
    'memberOf' => array( 0 => 'cn=unknown_people,ou=nowhere,dc=ad,dc=myuniveristy,dc=edu', 'count' => 1),
  );

$test_data['server']['users']['cn=verykool,ou=special guests,ou=guest accounts,dc=ad,dc=myuniveristy,dc=edu']['attr'] = array(
    'dn' => 'cn=verykool,ou=special guests,ou=guest accounts,dc=ad,dc=myuniveristy,dc=edu',
    'mail' => array( 0 => 'verykool@myuniversity.edu', 'count' => 1),
    'sAMAccountName' => array( 0 => 'verykool', 'count' => 1),
    'password' => array( 0 => 'goodpwd', 'count' => 1),
    'meMBErof' => array(
      0 => 'cn=sysadmins,ou=it,dc=ad,dc=myuniveristy,dc=edu',
      1 => 'CN=NETadmins,ou=it,dc=ad,dc=myuniveristy,dc=edu',
      'count' => 2,
      ),
  );

  $test_data['ldap_authorization_conf']['consumer_conf']['deriveFromEntry'] = 1;
  $test_data['ldap_authorization_conf']['consumer_conf']['deriveFromEntryEntries'] = array('ou=groups,dc=ad,dc=myuniveristy,dc=edu');
  $test_data['ldap_authorization_conf']['consumer_conf']['deriveFromEntryAttr'] = 'member';

  $test_data['ldap_authorization_conf']['consumer_conf']['mappings'][] = array('ou=content editors,ou=groups,dc=ad,dc=myuniveristy,dc=edu', 'content editors');
  $test_data['ldap_authorization_conf']['consumer_conf']['mappings'][] = array('ou=content approvers,ou=groups,dc=ad,dc=myuniveristy,dc=edu', 'content approvers');

This is in the 7.x-2.x branch and has simpletest coverage. The "group" definitions are in ldap server now and ldap authorization just takes care of mapping, filtering, etc to roles, og groups, etc.