Warning: The 1.99.6 and 1.99.7 implementation is broken if the user is not in app's db already :( Sorry for that.

Now (1.99.6) you can restrict login access based on ldap groups where the user is a member
You need just to specify allowed_groups:
 

auth.settings.login_methods=[ldap_auth(...as usual...,
  allowed_groups = [...],
  group_dn = 'ou=Groups,dc=domain,dc=com',
  group_name_attrib = 'cn',
  group_member_attrib = 'memberUid',
  group_filterstr = 'objectClass=*'
)]

You can now manage auth_groups and auth_membership automatically. You need to set manage_groups=True:

auth.settings.login_methods=[ldap_auth(...as usual...,
  manage_groups = True,
  db = db,
  group_dn = 'ou=Groups,dc=domain,dc=com',
  group_name_attrib = 'cn',
  group_member_attrib = 'memberUid',
  group_filterstr = 'objectClass=*'
)]

If the user can log in then ldap_auth set up the corresponding groups and memberships in app's db so RBAC can work properly and you don't have to set group membership  in ldap and in app's db too. Ther "group_*" properties are shared by allowed_groups and manage_groups.

Update: 2012.03.12.

From now in trunk, so above 1.99.7 you can manage user attrs as first name, last name, e-mail:

        auth.settings.login_methods.append(ldap_auth(...as usual...,
            manage_user = True,
            user_firstname_attrib = 'cn:1',
            user_lastname_attrib = 'cn:2',
            user_mail_attrib = 'mail'
            ))

        
Where:
manage_user - let web2py handle user data from ldap
user_firstname_attrib - the attribute containing the user's first name
                                optionally you can specify parts.
                                Example: cn: "John Smith" - 'cn:1' = 'John'
user_lastname_attrib - the attribute containing the user's last name
                                optionally you can specify parts.
                                Example: cn: "John Smith" - 'cn:2' = 'Smith'
user_mail_attrib - the attribure containing the user's email address
 

If ldap is using GnuTLS then you need cert_file="..." instead cert_path because cert_path isn't implemented in GnuTLS

Update: 2012.04.02.

Up from 2012.04.19.
You can customize the search for user:
   

        auth.settings.login_methods.append(ldap_auth(
            mode='custom', server='my.ldap.server',
            base_dn='ou=Users,dc=domain,dc=com',
            username_attrib='uid',
            custom_scope='subtree'))

Tested only with OpenLdap (I have no AD and co.)

If somebody can test it with AD please give me a feedback.