Satellite 6.2 and ActiveDirectory

Good morning all.

I am about to embark on tying our Satellite 6.2 server to ActiveDirectory. The documentation is pretty sparse when it comes to doing what I want to do.

The goal configuration goes something like this:

Members of AD Group "Satellite Administrator" should grant full admin access to the Satellite - all orgs, all roles - like "root" in unix.
Members of AD Group "Satellite Group 1" should grant access to Org A with satellite Role "custom_limited_role".
Members of AD Group "Satellite Group 2" should grant access to Org B with satellite Role "custom_limited_role".
Members of AD Group "Satellite Group 3" should grant access to Org C and Org D with satellite Role "custom_limited_role".
AD users without any membership in designated groups should fail at the login screen (fail at identity & authentication), not be able to pass the login screen and get to a screen where they have no access (pass identity and authentication, fail at authorization)

Is this /possible/ with Satellite, and is there any useful documentation?

-j