right now it cannot be done. i had studied basically 2ways to implement this.
1 implement the whole auth process within php application.
2 create an auth module which retrieves account information from the web server (like basic auth from $_SERVER ['user']) and then configure apache to do the ntlm part
I think the 2nd solution would be better, as it could be hooked to any other auth metod supported by apache, but it needs more skilled administrators to be set up.

to retrieve group information you'll probably need the Ad part anyway.

if anyone is willing to implement it i accept patches.