external LDAP instead of internal users/groups/roles