Added dynamical group authorization
do not skip empty groups when generating rules, they can be populated later
Added kerberos dynamic group authentication