>>In your case, when you authenticate a user by AD (using domain, username, and password), how would you assign a user to this or that user group?
Using ldp.exe (Microsoft optional LDAP testing app for Windows) against a giant AD forest, mygroup\myusername or myusername@mygroup seemed to work. It's possible that ldp.exe reassembles it into dn components, e.g. ou= so you could experiment - and ldp.exe has a console section that shows you the commands it's sending.
You can get ldp.exe on your own PC fairly easily, as it's a Windows component. Easiest to search online for latest instructions to add it.
"... They ne'er cared for us
yet: suffer us to famish, and their store-houses
crammed with grain; make edicts for usury, to
support usurers; repeal daily any wholesome act
established against the rich, and provide more
piercing statutes daily, to chain up and restrain
the poor. If the wars eat us not up, they will; and
there's all the love they bear us."
-- Shakespeare: Coriolanus, Act 1, scene 1
