added check for ldap group membership