make ldap group sync optional to just provide ldap auth