Thank you all for your help.  I was also working with support and we managed to come across the solution. While it is not ideal, it definitely works.  After mapping the AD identity to the LDAP identity all that was needed was to change the ACL policy setting to use BSD semantics which forces the GID to be inherited from the parent folder. The benefits - this drops the annoying primary group that is coming from AD.  Coming in from Windows SMB works terrific. CIFS mount and NFS also behave as the Isilon now agrees the user is the same person. The costs - A massive number of user joins will have to be scripted.  Since the user inherits the parent folder owner, this works fine for /project space, but not so well for /home.  I will have to script a user dir creation with a chgrp to the correct private GID.  I don't know if at load, the Isilon will struggle with 3000 mapping rules or not.  The scripting is not awful once I get it correct but I do hear the API is dog slow so I will have to use a local script with a cron.  Not perfect, but serviceable.
I am struggling with user/id mapping.  I have a variety of mapping rules but am missing one last piece. I have both OpenLDAP and Active Directory working correctly. I can successfully Export/Share a directory with both NFS and SMB I can successfully read/write/delete to that directory from both Linux and Windows The UID is correct from both Linux and Windows The GID is different between Linux and Windows  An ls -al of the directory on the Isilon will return: isilonNAS-1# ls -al total 77 drwxrwxr-x +   4 root            wheel                119 Jul  8 10:20 . drwxrwxr-x +  11 root            wheel                213 Jul  7 15:15 .. drwxrwx--- +  2 linuxusername  CORP\domain users       0 Jul  8 10:17   aWindowsDir -rwxrwx--- +   1 linuxusername  CORP\domain users       0 Jul  8 10:12   aWindowsfile.txt -rwxrwx--- +   1 linuxusername         linuxusername         0 Jul  8 10:10   alinuxfile -rwxrwx--- +   2 linuxusername         linuxusername         0 Jul  8 13:20   aLinuxDir          UID's match up but GID's dont.  So what is happening is when connecting from Windows, the Isilon is not using the On Disk GID but rather the first Supplemental identity from the CORP\linuxusername user.    So here is what I need to do I want to force the Isilon to use the On Disk GID always, or to map the Supplemental Identity to the Real GID or the On Disk GID. Doe anyone have any ideas?  Thanks for any guidance!!  more info below.  I have tried inserting, merging and appending GID, I have also tried removing supplemental groups but that errors.  isi auth mapping token examples   isilonNAS-1# isi auth mapping token --user=linuxusername                    User                        Name: linuxusername                         UID: 99888                         SID: S-1-22-1-99888                     On Disk: 99888                     ZID: 1                    Zone: System              Privileges: -           Primary Group                        Name: linuxusername                         GID: 99888                         SID: S-1-22-2-99888                     On Disk: 99888  An isi auth mapping token --user=CORP\\linuxusername  isilonNAS-1# isi auth mapping token --user=CORP\\linuxusername                    User                        Name: CORP\linuxusername                         UID: 1000102                         SID: S-1-5-21-2076390139-1363556362-999999998-888888                     On Disk: S-1-5-21-2076390139-1363556362-999999998-888888                     ZID: 1                    Zone: System              Privileges: -           Primary Group                        Name: linuxusername                         GID: 99888                         SID: S-1-22-2-99888                     On Disk: 99888 Supplemental Identities                        Name: CORP\domain users                         GID: 1000000                         SID: S-1-5-21-2076390139-1363556362--999999998--222  
Using AIMA - force GID for Windows users