I'm setting up SquidGuard (1.4) to validate users against an Active Directory domain and apply ACLs based on group membership; this is an example of my squidGuard.conf:

src AD_Group_A {
        ldapusersearch  ldap://my.dc.name/dc=domain,dc=com?sAMAccountName?sub?(&(sAMAccountName=%s)(memberOf=cn=Group_A%2cdc=domain%2cdc=com))
}

src AD_Group_B {
        ldapusersearch  ldap://my.dc.name/dc=domain,dc=com?sAMAccountName?sub?(&(sAMAccountName=%s)(memberOf=cn=Group_B%2cdc=domain%2cdc=com))
}

dest dest_a {
    domainlist  dest_a/domains
    urllist     dest_b/urls
    log     dest_a.log
}

dest dest_b {
    domainlist  dest_b/domains
    urllist     dest_b/urls
    log     dest_b.log
}

acl {
    AD_Group_A {
        pass    dest_a !dest_b all
        redirect http://some.url
    }

    AD_Group_B {
        pass    !dest_a dest_b all
        redirect http://some.url
    }

    default {
        pass    !dest_a !dest_b all
        redirect http://some.url
    }
}

All works fine if an user is member of Group_A OR Group_B. But if an user is member of BOTH groups, only the first source rule is evaluated, thus applying only the first ACL.

I understand this is due to how source rule matching works in SquidGuard (if one rule matches, evaluation stops there and then the related ACL is applied); so I tried this, too:

src AD_Group_A_B {
        ldapusersearch  ldap://my.dc.name/dc=domain,dc=com?sAMAccountName?sub?(&(sAMAccountName=%s)(memberOf=cn=Group_A%2cdc=domain%2cdc=com))
        ldapusersearch  ldap://my.dc.name/dc=domain,dc=com?sAMAccountName?sub?(&(sAMAccountName=%s)(memberOf=cn=Group_B%2cdc=domain%2cdc=com))
}

acl {
    AD_Group_A_B {
        pass    dest_a dest_b all
        redirect http://some.url
    }

    [...]
}

But this doesn't work, too: if an user is member of either one of those groups, the whole source rule is matched anyway, so he can reach both destinations (which is of course not what I want).

The only solution I found so far is creating a THIRD group in AD, and assign a source rule and an ACL to it; but this setup grows exponentially with more than two or three destination sets.

Is there any way to handle this better?