add some tests for ldap group memberships