extended ldap groups enabled removes ability to create roles

Follow-up: I used the Rules module to create a rule to automatically assign every user to a role when the account is created or when they log in. The user is successfully assigned to a role in Drupal, but provisioning does not add them to the corresponding group in ldap. How can I trigger this automatically?

We were in a bit of a desperate deadline situation so we came up with a solution that isn't nearly as elegant as your module but for what it's worth here it is.
We used the Rules module to assign all authenticated users to a new role when they create an account. The role and associated ldap group already exist.
We added a new case statement to Extended Groups: when a user logs in it sends an array of their current role memberships to the ldap - the original Extended Groups actually does a comparison when the user is updated in Drupal and it writes or removes users from groups based on that difference, our hack just sends the roles every time the user logs in (like I said, not pretty...). We didn't write anything that would automatically remove a user from a group for any trigger.

the new case statement, inserted the hook_user section after it manages the roles changes and blocking, after line 76:

// Added by MP on 8/27/2010
case 'login':
// At login send roles to extended_ladpgroups_add_group_membership since some roles are being added directly in the db
if (array_key_exists('roles', $edit)) {
$roles_added = array_keys($account->roles);
if(!empty($roles_added)){
extended_ladpgroups_add_group_membership($account, $roles_added);
}
}
break;

We just got this working and did preliminary testing - I'll be doing more thorough testing next week and let you know if I learn anything. If I didn't say it before, thanks for the module, it' really vital to our project. Although I'm still stumped on why I can't create roles when Extended Groups is on but that's workable...

Sorry I haven't send the schema yet - my ldap interface is far to simplistic - just wanted to let you know I'm working on it - thanks.

I love this idea - hand hitting forehead "of course!"
Worked like a charm thanks.
Word to the wise - i couldn't have both the dummy
uniquemember: cn=dummy,ou=people,dc=example,dc=com
and the generic
uniquemember: !members
in the same ldif - I had to remove the !members - which makes sense
thank you!!