Hi Alex, inside jBPM5 you only need to keep a small representation of what an user or a group represent for you, in order to be able to do the look up to your external data source like LDAP. What jBPM5 stores is only a way to retrieve that reference in your external system. If you think about it this is a good practice because jBPM5 internally don't need to know about your LDAP repository at all. As you mention, yes you need to keep the relationships and can be considered as duplicate information towards to have your LDAP repository totally decoupled from jBPM5. It's also good to notice that if you describe your business processes and assign tasks to different groups and users, you will have the information about the users and groups that will need to be available in the mappings. We can think a way to automate that mappings.
Greetings. Hope it helps.