updated to add "required_group" ldap setting.  default is blank.  if a value is provided, the LDAP class will authenticate on the group name