Based on: https://trello.com/c/VYv11XsM/484-5-build-ldap-sync-for-groups-as-first-class-objects.
This was documented with the 3.1 version here: https://docs.openshift.com/enterprise/3.1/install_config/syncing_groups_with_ldap.html. Closing this bug.