cacheable groups for ldap