I just deployed tinyauth and it actually supports ldap and it can read also ldap groups. Gonna tinker with it more tomorrow, but so far I like the simplicity a lot.