[Setup] LDAP: mapping OU matches to plone groups

[Todd, David]

Here's the situation: We have LDAP, in the form of Active Directory. I want
to be able to tag users with various OU's, so that when I search for all the
users that match an OU, I get, in essence, a group.

"Aha!", you might say, "Why not just make groups in AD?"

Because when a user leaves the company, All I have to do is remove those OU
tags from his record, instead of having to modify some number of group
files.

So, my question is how do I get plone to check to see if a user has a
specific OU attached to their record as a method for checking group
membership?