groups are now dynamically loaded from ldap