authorization based on ldap attribute