src/model/UserDbLdap.php
public function updateGroupAssignment() {
        if(static::getExtensionOptions('ENABLE_YII2_PROFILING') == true) {
            Yii::beginProfile('updateGroupAssignment', static::YII2_PROFILE_NAME . 'updateGroupAssignment');
        }
        
        $ldapGroupsAssignedToUser = $this->getGroupsAssignedInLdap(); //Query LDAP groups assigned to user
        $yiiRolesAssignedToUser = Yii::$app->authManager->getRolesByUser($this->getId()); //Get all roles assigned to user
        $yiiAvailableRoles = Yii::$app->authManager->getRoles(); //Get all avaliable roles in yii2
        
        //Map groups from LDAP to roles and add to user object.
        if (static::getGroupAssigmentOptions('ADD_GROUPS_FROM_LDAP_MATCHING_REGEX',$this->individualGroupAssignmentOptions) == true) {
            foreach ($ldapGroupsAssignedToUser as $gn) {
                if(preg_match(static::getGroupAssigmentOptions('REGEX_GROUP_MATCH_IN_LDAP',$this->individualGroupAssignmentOptions),$gn) == true) {                    
                    if(array_key_exists($gn,$yiiAvailableRoles) && !array_key_exists($gn,$yiiRolesAssignedToUser)) {
                        if ($this->isNewRecord) {
                            $this->generateAuthKey();
                            $this->updateAccountStatus();                        
                            $this->save(); //Save to db to get id from database
                        }
                        $auth = Yii::$app->authManager;
                        $role = $auth->getRole($gn);
                        $auth->assign($role, $this->getId());                
                    }       
                }
            }
        }
        
        //Remove all roles from user object which are not in LDAP
        if (static::getGroupAssigmentOptions('REMOVE_ALL_GROUPS_NOT_FOUND_IN_LDAP',$this->individualGroupAssignmentOptions) == true && 
            static::getGroupAssigmentOptions('REMOVE_ONLY_GROUPS_MATCHING_REGEX',$this->individualGroupAssignmentOptions) == false) {
            foreach ($yiiRolesAssignedToUser as $role) {
                if(in_array($role->name,$ldapGroupsAssignedToUser) == false) {
                        $auth = Yii::$app->authManager;
                        $auth->revoke($role, $this->getId());                     
                }
            }            
        }
        
        //Remove all roles from user object which are matching the regex and are not in LDAP
        if (static::getGroupAssigmentOptions('REMOVE_ONLY_GROUPS_MATCHING_REGEX',$this->individualGroupAssignmentOptions) == true) {
            foreach ($yiiRolesAssignedToUser as $role) {
                $roleName = $role->name;
                
                if(preg_match(static::getGroupAssigmentOptions('REGEX_GROUP_MATCH_IN_LDAP',$this->individualGroupAssignmentOptions),$roleName) == true && 
                   in_array($roleName,$ldapGroupsAssignedToUser) == false) {
                            $auth = Yii::$app->authManager;
                            $auth->revoke($role, $this->getId());
                }
            }
        }
        
        $rolesAfterUpdate = Yii::$app->authManager->getRolesByUser($this->getId());
        
        if(static::getExtensionOptions('ENABLE_YII2_PROFILING') == true) {
            Yii::endProfile('updateGroupAssignment', static::YII2_PROFILE_NAME . 'updateGroupAssignment');
        }
        
        //Return assigned roles.
        return $rolesAfterUpdate;
    }
public function updateGroupAssignment() {
        if(static::getExtensionOptions('ENABLE_YII2_PROFILING') == true) {
            Yii::beginProfile('updateGroupAssignment', static::YII2_PROFILE_NAME . 'updateGroupAssignment');
        }
        
        $ldapGroupsAssignedToUser = $this->getGroupsAssignedInLdap(); //Query LDAP groups assigned to user
        $yiiRolesAssignedToUser = Yii::$app->authManager->getRolesByUser($this->getId()); //Get all roles assigned to user
        $yiiAvailableRoles = Yii::$app->authManager->getRoles(); //Get all avaliable roles in yii2
        
        //Map groups from LDAP to roles and add to user object.
        if (static::getGroupAssigmentOptions('ADD_GROUPS_FROM_LDAP_MATCHING_REGEX',$this->individualGroupAssignmentOptions) == true) {
            foreach ($ldapGroupsAssignedToUser as $gn) {
                if(preg_match(static::getGroupAssigmentOptions('REGEX_GROUP_MATCH_IN_LDAP',$this->individualGroupAssignmentOptions),$gn) == true) {                    
                    if(array_key_exists($gn,$yiiAvailableRoles) && !array_key_exists($gn,$yiiRolesAssignedToUser)) {
                        if ($this->isNewRecord) {
                            $this->generateAuthKey();
                            $this->updateAccountStatus();                        
                            $this->save(); //Save to db to get id from database
                        }
                        $auth = Yii::$app->authManager;
                        $role = $auth->getRole($gn);
                        $auth->assign($role, $this->getId());                
                    }       
                }
            }
        }
        
        //Remove all roles from user object which are not in LDAP
        if (static::getGroupAssigmentOptions('REMOVE_ALL_GROUPS_NOT_FOUND_IN_LDAP',$this->individualGroupAssignmentOptions) == true && 
            static::getGroupAssigmentOptions('REMOVE_ONLY_GROUPS_MATCHING_REGEX',$this->individualGroupAssignmentOptions) == false) {
            foreach ($yiiRolesAssignedToUser as $role) {
                if(in_array($role->name,$ldapGroupsAssignedToUser) == false) {
                        $auth = Yii::$app->authManager;
                        $auth->revoke($role, $this->getId());                     
                }
            }            
        }
        
        //Remove all roles from user object which are matching the regex and are not in LDAP
        if (static::getGroupAssigmentOptions('REMOVE_ONLY_GROUPS_MATCHING_REGEX',$this->individualGroupAssignmentOptions) == true) {
            foreach ($yiiRolesAssignedToUser as $role) {
                $roleName = $role->name;
                
                if(preg_match(static::getGroupAssigmentOptions('REGEX_GROUP_MATCH_IN_LDAP',$this->individualGroupAssignmentOptions),$roleName) == true && 
                   in_array($roleName,$ldapGroupsAssignedToUser) == false) {
                            $auth = Yii::$app->authManager;
                            $auth->revoke($role, $this->getId());
                }
            }
        }
        
        $rolesAfterUpdate = Yii::$app->authManager->getRolesByUser($this->getId());
        
        if(static::getExtensionOptions('ENABLE_YII2_PROFILING') == true) {
            Yii::endProfile('updateGroupAssignment', static::YII2_PROFILE_NAME . 'updateGroupAssignment');
        }
        
        //Return assigned roles.
        return $rolesAfterUpdate;
    }
public function updateGroupAssignment ( ) { if ( static :: getExtensionOptions ( 'ENABLE_YII2_PROFILING' ) == true ) { Yii :: beginProfile ( 'updateGroupAssignment' , static :: YII2_PROFILE_NAME . 'updateGroupAssignment' ) ; } $ ldapGroupsAssignedToUser = $ this -> getGroupsAssignedInLdap ( ) ; //Query LDAP groups assigned to user
 $ yiiRolesAssignedToUser = Yii :: $ app -> authManager -> getRolesByUser ( $ this -> getId ( ) ) ; //Get all roles assigned to user
 $ yiiAvailableRoles = Yii :: $ app -> authManager -> getRoles ( ) ; //Get all avaliable roles in yii2
 //Map groups from LDAP to roles and add to user object.
 if ( static :: getGroupAssigmentOptions ( 'ADD_GROUPS_FROM_LDAP_MATCHING_REGEX' , $ this -> individualGroupAssignmentOptions ) == true ) { foreach ( $ ldapGroupsAssignedToUser as $ gn ) { if ( preg_match ( static :: getGroupAssigmentOptions ( 'REGEX_GROUP_MATCH_IN_LDAP' , $ this -> individualGroupAssignmentOptions ) , $ gn ) == true ) { if ( array_key_exists ( $ gn , $ yiiAvailableRoles ) && ! array_key_exists ( $ gn , $ yiiRolesAssignedToUser ) ) { if ( $ this -> isNewRecord ) { $ this -> generateAuthKey ( ) ; $ this -> updateAccountStatus ( ) ; $ this -> save ( ) ; //Save to db to get id from database
 } $ auth = Yii :: $ app -> authManager ; $ role = $ auth -> getRole ( $ gn ) ; $ auth -> assign ( $ role , $ this -> getId ( ) ) ; } } } } //Remove all roles from user object which are not in LDAP
 if ( static :: getGroupAssigmentOptions ( 'REMOVE_ALL_GROUPS_NOT_FOUND_IN_LDAP' , $ this -> individualGroupAssignmentOptions ) == true && static :: getGroupAssigmentOptions ( 'REMOVE_ONLY_GROUPS_MATCHING_REGEX' , $ this -> individualGroupAssignmentOptions ) == false ) { foreach ( $ yiiRolesAssignedToUser as $ role ) { if ( in_array ( $ role -> name , $ ldapGroupsAssignedToUser ) == false ) { $ auth = Yii :: $ app -> authManager ; $ auth -> revoke ( $ role , $ this -> getId ( ) ) ; } } } //Remove all roles from user object which are matching the regex and are not in LDAP
 if ( static :: getGroupAssigmentOptions ( 'REMOVE_ONLY_GROUPS_MATCHING_REGEX' , $ this -> individualGroupAssignmentOptions ) == true ) { foreach ( $ yiiRolesAssignedToUser as $ role ) { $ roleName = $ role -> name ; if ( preg_match ( static :: getGroupAssigmentOptions ( 'REGEX_GROUP_MATCH_IN_LDAP' , $ this -> individualGroupAssignmentOptions ) , $ roleName ) == true && in_array ( $ roleName , $ ldapGroupsAssignedToUser ) == false ) { $ auth = Yii :: $ app -> authManager ; $ auth -> revoke ( $ role , $ this -> getId ( ) ) ; } } } $ rolesAfterUpdate = Yii :: $ app -> authManager -> getRolesByUser ( $ this -> getId ( ) ) ; if ( static :: getExtensionOptions ( 'ENABLE_YII2_PROFILING' ) == true ) { Yii :: endProfile ( 'updateGroupAssignment' , static :: YII2_PROFILE_NAME . 'updateGroupAssignment' ) ; } //Return assigned roles.
 return $ rolesAfterUpdate ; }
Update the group assignment of the user object
The Yii::$app->params['LDAP-Group-Assignment-Options'] has several options how to update the group assignment.

Basicly a query to LDAP is done which returns the groups assigned to the user in the LDAP directory.
Depending on the settings in the params groups are added or removed from the user object.

For a description of the options see the top of this class, where templates (e.g. GROUP_ASSIGNMENT_TOUCH_ONLY_MATCHING_REGEX) are defined.
This Templates can be used directly in params or you can define each param by yourself.

Example config/params.php
return [
...
'LDAP-Group-Assignment-Options' => Edvlerblog\Adldap2\model\UserDbLdap::GROUP_ASSIGNMENT_TOUCH_ONLY_MATCHING_REGEX,
...
];

@return Role[] all roles directly assigned to the user. The array is indexed by the role names.
Update the group assignment of the user object The Yii :: $app - > params [ LDAP - Group - Assignment - Options ] has several options how to update the group assignment .