Add api for getting groups from identity source.
Clean up ldap auth a little.
Add ldap group role mapping.
Rework to support multiple roles.