The following is what I did to limit the users and groups that were returned from Active Directory into Openfire:

1) Create security group called, "Openfire Users"

2) Create security group called, "Openfire Groups"

3) Add users in AD to the "Openfire Users" security group that you want to have access

4) Add security groups in AD (such as: IT, Accounting, Department1, Department2, etc...) that define the users in step 3 to the "Openfire Groups"

5) Configure Openfire Setup with the following:

base dn: DC=company,DC=local

user filter: (memberOf=CN=Openfire Users,CN=Users,DC=company,DC=local)

group filter: (memberOf=CN=Openfire Groups,CN=Users,DC=company,DC=local)

Notes:

- I had to setup my "Openfire Groups" security group as a "Domain Local" type, so that other security groups (Global) could be properly added as members.

- I recommend setting up a few users into "Openfire Users" and a few groups into "Openfire Groups" and testing the configuration within the Openfire Setup to verify that everything is working properly, before you spend too much time doing this for 100s of users.

The Openfire Setup will allow you to choose Admin users who can manage Openfire, after you have setup LDAP.  But the Admin users cannot be maintained through AD.

-- Curt