admin can now choose identifier for the ldap group solely on his own. wont use concept of prefix+fqdn anymore