While there is no automatic synchronisation available at present for LDAP to delegated directories, we do have a request to develop this. You may like to create an account on our public issue tracker and set a watch on the issue to be notified of any updates. You're also welcome to vote and comment on the request to help us determine our product roadmap. The request also links to a third-party plugin which could potentially form the basis for your own synchronisation. Our apologies that we're not able to offer a clean solution to your situation yet. We're still developing the best approach to dealing with group management in locked-down LDAP setups and will work to make this as simple as possible over time. You are welcome to comment on CWD-962 for advice on the best way to handle this in the interim.