improved ldap group support