Rails 3 & devise_ldap_authenticatable: Authorization against Active Directory?

I successfully have my Rails 3 app running with devise and devise_ldap_authenticatable to authenticate against the local Active Directory.

Now I want to add authorization capabilities in order to allow access only to AD users that belong to certain AD groups.

So to start simple, I first have looked up my own user in AD with the linux command ldapsearch. The result contained something like ...

(...)
memberOf: CN=my,OU=foo,DC=bar,DC=role,DC=domain,DC=com
memberOf: CN=my,OU=foo,DC=bar2,DC=role,DC=domain,DC=com
memberOf: (...)
(...)

Ok, now I decided, that I want to restrict access to members of CN=my,OU=foo,DC=bar,DC=role,DC=domain,DC=com.

So, I changed my ldap.yml to contain:

authorizations: &AUTHORIZATIONS
  group_base: ou=role,dc=domain,dc=com
  required_groups:
    - CN=my,OU=foo,DC=bar,DC=role,DC=domain,DC=com

development:
  (...)
  <<: *AUTHORIZATIONS

And in addition changed my devise.rb to contain:

Devise.setup do |config|
  config.ldap_logger = true
  config.ldap_create_user = true
  config.ldap_update_password = false
  config.ldap_check_group_membership = true # <-- activated this line
  config.ldap_use_admin_to_bind = true
  #config.ldap_ad_group_check = true <-- don't know what this is good for

Now, when trying to authenticate, access is denied, which I did not expect:

User CN=myuser,OU=org,DC=domain,DC=com is not in group: CN=my,OU=foo,DC=bar,DC=role,DC=domain,DC=com

Any idea, how authorization against AD is accomplished with devise_ldap_authenticatable? The documentation of this module is not yet that comprehensive when it comes to authorization.