[keycloak-user] ldap synch filtered by group membership