LDAP Authorization: dangerous iterations using og_load_multiple & og_get_all_group()

Hey guys, I'm digging in on setting up OG and LDAP to work together & i've dug up at least this problem:

  public function usersAuthorizations(&$user) {
     $groups = og_load_multiple(og_get_all_group()); 
		$authorizations = array();
		if (is_object($user) && is_array($groups)) {
			foreach ($groups as $gid => $discard) {
				$roles = og_get_user_roles($gid, $user->uid);
				foreach ($roles as $rid => $discard) {
					$authorizations[] = ldap_authorization_og_authorization_id($gid, $rid);
				}
			}
		}
    return $authorizations;
  }

this function loads every group and iterates through them every time it runs. On systems with a small number of groups this is fine, but this wont be typical - especially in an enterprise env. the organization I'm currently working with only has 280 groups and 3 group roles, but my previous client had over 30,000 groups and 4+ group roles. this presents a serious scaling problem because in traditional groups architectures all group roles are available to all groups. This means you have an N times X problem where the loops are going to process x times for each node. If this ran on my previous client's system, the admin page would show 120,000 example records (30k groups x 4 possible group roles). Adding an additional group role would cause the loops to run another 30k times.

The two places i see the following code used $groups = og_load_multiple(og_get_all_group()); are in the formatter examples page in admin (less of a problem, but still a big problem) and the userAuthorizations function (more of a problem because normal users can essentially run it).

The admin examples can be simplified by limiting the data to only a few nodes, but the userAuthorizations function is going to need to be refactored. There should be a better way to determine these authorizations somehow. I'm working on at least allowing a field to be attached to the group so that the group DN can be placed there. This will at least let the authorization be searchable in the DB to reduce the PHP data loading & looping that is happening here.

Anyone have any added thoughts on this?
-Chris