Oh, I'm doing it in reverse so what I have is the following

workflow.scratchpad.user = "TMiller";

workflow.scratchpad.addgroups = "Group1,Group2";

My workflow will add TMiller to Group1 and then loop through and add TMiller to Group2 and then complete.  Unfortunately, I did not setup my workflow to do multiple users, but I'm sure that it could be done, you would just need to add another if condition and loop back to the if condition and set the workflow.scratchpad.user variable to another user and loop through the groups again.

My variable names are same as yours but this is what I am doing. Should I still need another if condition?

Run Script

workflow.scratchpad.addgroups ="TMiller,KGayson";
workflow.scratchpad.addgroup = workflow.scratchpad.addgroups.split(",");
workflow.scratchpad.addcount = workflow.scratchpad.addgroup.length; // the overall count available
workflow.scratchpad.addcounter = 0;   // our counter
gs.log("Add Group List: " + workflow.scratchpad.addgroups + " | User: " + workflow.scratchpad.user);
gs.log("Add Group Length: " + workflow.scratchpad.addcount + " | User: " + workflow.scratchpad.user);

Add User to Group:

Domain Name: 17*.*.*.*

Username: ${workflow.scratchpad.addgroup[workflow.scratchpad.addcounter]}

Group Name: _TestDistributionGroup1

If Condition: Just same as yours

answer = ifScript(); 
 
function ifScript() { 
   var check_add = 'no'; 
   workflow.scratchpad.addcounter ++;  // increment the counter 
         
   // check the counter and see if we need to go again or stop 
   if (workflow.scratchpad.addcounter < workflow.scratchpad.addcount) { 
      check_add = 'yes'; 
   } 
         
   return check_add; 
} 

This works great for adding and removing users, do you happen to have an addition where if the user is already in the group it skips and moves to the next, right now the "add user to group" will go down the failure path if the users are already in the selected groups 

you'd probably have to do some sort of AD query and grab a list of current ad groups then run a arrayUtil.diff to get the list of groups they don't have.

so if you just have that form set up in the service catalog and you only pick one option from the drop down and then submit, I would have a workflow that has an if statement that forks to two options and depending on whether you pick add or remove from ad as your action I would generate the add/remove from ad group on the workflow. So if they pick

create a variable on the form called requested_for, (hide it or show it) write an onLoad script that populates the logged in user and sets it.

ACTION:

add

Domain: //variable name (u_domain)?

main / primary:

AD Group: //variable name (u_group)?

test ad group

then your add/remove activity would be

username:

${current.variables.requested_for}

domain:

${current.variables.u_domain}

group:

${current.variables.u_group}