Ah ha, thought how to reduce the problem size down to 12 groups 🙂

Since the Roles with multiple groups consist of <=12 groups all I need to to do is filter the LDAP data and reduce it those entries that are in the set of groups that are part of multi group roles!...yippeee

Original problem is

A role consists of between 1 and x groups from a set of x groups.

A role can only have a particular group once.

A user may have more than one role

Example:

Role | Group

Helpdesk | Password Reset

Security | Password Reset,

Security | Enable User

Reception | Enable User

Reception | Disable User

The data I have is of the form

User | Group

SmithA | Password Reset

SmithA | Enable User

BloggsJ | Password Reset

MouseM | Enable User

MouseM | Disable User

From that I need to deduce the users have the following roles

User | Role

SmithA | Security

BloggsJ | Helpdesk

MouseM | Reception

Thanks