Ldap and groups/roles

I'm using ldap in zope to authenticate against an Active Directory. 
This works fine for the most part but would like to start taking 
advantage of groups. But am having some difficulty finding 
documentation on using groups.

By groups, I do not mean OU's ... which are simple to use:

ou=My OU,dc=libraries,dc=wvu,dc=edu

Will find anyone in the "My OU" organizational unit.

Unfortunately a user cannot belong to more than one OU, but they can 
belong to multiple groups.

When clicking on the users tab in the zope ldap users folder i can see 
all of the groups and ou's in the active directory listed, so zope ldap 
CAN see the groups. My question is, why is the syntax to specify a 
group instead of an OU?

i've tried to following:
cn=mygroup,dc=libraries,dc=wvu,dc=edu

which, according to everything i've found on the web, should work. but 
it doesn't.

Mike.