How to set up permissions for multiple groups at different levels in ldap in EPP 5?

Issue

We need to grant same permissions to 2 user groups at different levels in the ldap tree. The following is the ldap structure:

- mycompany (root)
  - groups
    - intranet.groups.users
    - someapp.groups.users
    - ...
  - users
    - userid1
    - userid2
    - ...
  - suborganization
    - groups
      - intranet.groups.suborg_users
      - someapp.groups.users
    - users
      - useridA
      - useridB
      - ...
  - ...

We would like to grant the intranet.groups.user and intranet.groups.suborg_user same permission for certain portlets/pages.

The group intranet.groups.user is directly under the root mycompany tree with a ctxDNs = ou=Groups,dc=mycompany,dc=com.  This group member users are from ctxDNs = ou=people,dc=mycompany,dc=com.

The group intranet.groups.suborg_user is under a suborganization tree wit a ctxDNs = ou=Groups,o=suborganizationn, dc=mycompany,dc=com.  The member users are from ctxDNs = ou=people,o=suborganization,dc=mycompany,dc=com.

We are able to grant portlet/page permissions for intranet.groups.users, and they working as expected. But we could not make the group intranet.groups.suborg_users to work.