Cisco Posted a new Configuration Guide on how to use LDAP to map users to roles. This is relevant for any deployment integrating with LDAP as an auth server (e.g. Active Directory) or performing LDAP lookup with AD SSO.
NAC(CCA) 4.x: Map Users to Certain Roles Using LDAP Configuration Example
Make sure you check it out before your next LDAP auth server deployment.