make LDAP group searches configurable