We use LDAP for authentication only (no group membership). What we have found is that when a user first authenticates via LDAP a user is created in zenoss and we have no abilities to modify that users access beyond the default group we assign when initially creating the user. At that point, we delete that users account and re-add the user in zenoss manually. At that point the user can be modified and see the events console depending on his access type + still uses ldap for authentication.
Not sure this is the same issue you guys are seeing -
Rob