DEFAULT LDAP-Group != "allusers", Auth-Type := Reject
