7 - Mapping multiple LDAP groups to single Drupal roles using Boolean operators I'm attempting to set up fairly complex permissions in D7 based on LDAP group membership, and it would help greatly if there were a way to use Boolean operators to perform the role mapping.

Some context:


There are multiple, similar departments: each has a pool of employees, and each has a manager.
LDAP groups map to departments as well as roles. The manager of the Finance department belongs to two groups: one that designates the group Finance_dept, another that designates the group Managers.
Managers should have R/W access to parts of the site that correspond only to their respective departments; employees should only have R access.


What I've tried (and ruled out):

I have the LDAP module configured to provision Drupal roles based on LDAP group membership--that piece works well for one-to-one mappings; e.g.:


Finance_dept|finance
Managers|managers


I've tried various iterations of LDAP search filters, to no effect:


Finance_dept &amp; Managers|finance_managers
(&amp;(Finance_dept)(Managers))|finance_managers


Has anyone gotten this to work?
Until I can find (or someone else posts) a better way to do this, my interim solution is:


Set up LDAP group -> Drupal role provisioning as normal.
Use the Rules module to assign/revoke another role programmatically on events User has logged in, and Before saving a user account.


Example (referring to my question above):

LDAP Provisioning:


Finance_dept|finance
Managers|managers


Create roles manually:


financemanagers


Rules:

Finance_dept + Managers = FinanceManagers


Events: User has logged in, Before saving a user account
Elements: User has role(s): finance, managers
Actions: Add user role: financemanagers


Removed from either Finance or Managers


Events: User has logged in, Before saving a user account
Elements: 

NOT User has role(s): finance
OR
NOT User has role(s): managers

Actions: Remove user role: financemanagers


Works for now, but it won't scale well beyond a handful of role combinations.