make ldap group sync optional to just provide ldap auth
merge optional group