For now, I'd leave it there. The seperation is not very clear indeed, and it the idea to put it to group_ldap.php (i think you mean this) is not far off. Nevertheless, in user_ldap.php and group_ldap.php work rather like a "frontend" for the user and group management staff while the internal logic is in access.php. There are also other user- or group specific methods.