Add an ldap-groups authz mechanism