You've got to set up some group checking...you haven't, so ldap-group means nothing to the server so you hit the default reject that you added...

alan