LDAP is actually more reasonable for groups

LDAP needs to win when defining whe 'admin' group, for instance.