ops ldap group too restrictive

Change-Id: I85caeecb99fd9b6d36063b9769f06ee7a6f966c0