LDAP authentication does not work with AD groups. Why?