I haven't tried that version but I already know that the ad specific LDAP_MATCHING_RULE_IN_CHAIN oid breaks very large installations. One LDAP query will take over 1.5 minutes and will be killed by the ad server.
Last I looked using ad browser which was a few weeks my memberOf did not include groups that groups where members of so would give different results than you are expecting -- You received this message because you are subscribed to the Google Groups "Jenkins Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-users+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
