Apache Syncope can manage users, groups and memberships (memberOf/members attribute) on external Active Directory via ConnId's Active Directory (JNDI) connector. Think you manage users and roles on Apache Syncope as centralized IdM, and have all these entities automatically kept in sync with your Active Directory users and groups: few simple steps onto the Apache Syncope administration console will help you to succesfully aim your goals ....