role_attribute: 'cn'
role_filter: '(objectClass=group)'