Thread:Extension talk:LDAP Authentication/Authenticating against group A or B/reply

I recommend using group syncronization, then adding/removing appropriate rights to each group.