How do I map active directory group membership (ldap authorization) to og groups in open atrium?
I had this same problem recently whereby this was originally working:

GroupA|IT:member
GroupA_Admins|IT:member
GroupA_Admins|IT:administrator member


During this course of development this stopped working and on alternate logins a user in that LDAP group would either be a member of the organic group, or not (but never an administrator of that group).

I eventually worked out that it had stopped working because I had since overridden the permissions of the space, which meant that the OG role ids were different, even though they had the same name.

Therefore:

GroupA|IT:member
GroupA_Admins|IT:member
GroupA_Admins|IT:administrator member


was being automatically converted to

GroupA|IT:member (raw: node:3:5)
GroupA_Admins|IT:member (raw: node:3:5)
GroupA_Admins|IT:administrator member (raw: node:3:6)


when actually since it was no longer using the default roles, it should have been using 8 and 9 instead of 6 and 7.

Rewriting the mapping to explicitly use the ids for the overriding roles rather than their names worked:

GroupA|node:3:8
GroupA_Admins|node:3:8
GroupA_Admins|node:3:9


I know this is a very old post to reply to, but I was struggling with this yesterday so hope it helps someone else in future.