Efficient AD group matching via the new wbclient interface

Hello all, I am working on improving AD group matching for mschap authentication, taking advantage of the new wbclient direct interface which returns the user's token (including group membership SIDs) as part of NTLM authentication. Work in progress: https://github.com/frenche/freeradius-server/commit/9af7dfd634a251f68b070646... I'm now thinking on how to implement the caching of group-name to SID mapping with configurable timeout, ideally using existing interface - ideas welcome. @mcnewton, I noticed at last there is a similar group-compare function in v4 branch, though I think the two actually can complete each other. Thoughts? Thank you, Isaac B.