I think I've found a solution:
http://bugs.splitbrain.org/index.php?do=details&task_id=2104&project=1&order=attachments&sort=desc
and I have the following settings in local.php
$conf['auth']['ldap']['reqgrouptree'] = 'OU=Groups,OU=Staff,DC=f1,DC=l1';
$conf['auth']['ldap']['reqgroupfilter'] = '(&(cn=Dept_Marketing)(member=%{dn}))';
Thanks Tycho for writing this patch.