NOJIRA Oops. At least be consistent.
PROV-835 Re-added group membership check

This check is still just as complicated and inefficient as before but
OpenLDAP still has no means to get a list of groups from a user record.
At least not without special setup. See
http://www.openldap.org/doc/admin24/overlays.html

It’s possible but it’s a hassle. So we don’t assume.