added support to return a list of group memberships

There is already a configuration parameter for this, we should use that not a constant, as this isn't necessarily constant across all LDAP servers.