[LDAP] Support global permission flags by LDAP group