LDAP: now using Agency Groups and giving rights to each unit