LDAP and Active Directory authorization without changing the application

LDAP and Active Directory groups encode the access rules for applications nobody will fund a rewrite for. Covers resolving those groups at the proxy in front of the application, turning them into an input to policy rather than the access model itself, cache staleness, and where boundary enforcement stops.