So as far as I have come to unserstand CFengine, the promise bundles in the bundlesequence in the common control body are evaluated in order. The icinga bundle comes before ldapserver which runs /usr/bin/ldap-debian-edu-install which in turn starts slapd. The installer log confirms that icinga is run before ldapserver. So putting the icinga bundle after ldapserver might fix the availability of the group via LDAP. However, this still needs testing.
-- Guido Berhoerster
