finish up code for discovering/synchronising group membership on LDAP