This is a thing that has always bothered me: how am I best to handle Debian standard groups for LDAP users?

Debian has a number of groups defined by default, e.g. plugdev, audio, cdrom and so on. These control access in standard Debian installs.

When I want a user from LDAP to be a member of the `audio' group on all machines they log in to, I've tried a few different things:

• Adding them to the local group on the machine (this works but is hard to maintain)
• Creating a group in LDAP with the same name and a different GID then adding the user to that group (breaks reverse / forward GID mapping, doesn't seem to work)
• Creating a group in LDAP with the same name and same GID and adding the user to that group (doesn't seem to work at all, things don't see the LDAP group members)
• Creating a group in LDAP with the same name and same GID then removing the local group (this works but upsets Debian's maintenance scripts during upgrades that check for local system sanity)

What's the best practice for this scenario?