Assigning edupersonaffiliation attribute with AD

[Rod Widdowson]

> How do you all assign the eduPersonAffiliation attribute to your users?
> Currently we use the following script to assign it based on Organisational
> Unit, but this is starting to prove too limiting as we have users within
the
> same OUs that I’d like to assign different edupersonaffiliation attributes
to.

I know nothing of AD, but I happened to be reviewing the samples recently.
Can 

https://wiki.shibboleth.net/confluence/display/SHIB2/ResolverScriptAttribute
DefinitionExamples

Provide any help ?  In particular “generate eduPersonAffiliation based on
recursive group membership in Active Directory” looks at memberOf() which
might be interesting for you.