new version able to handle LDAP groups