I am still having trouble with this.
I do not know where to shim-in my call to my external function
getNTGroups() to add to the local roles. It does work right now, but it
is being called for _every_ object so is very slow.
I guess my trouble is I do not understand how to get this cached instead
of getting it from the PDC every time.