$wgLDAPExcludedGroups does not work alone
I am running LDAP Authentication Plugin (Version 1.2d) (r83086) and I discovered that $wgLDAPExcludedGroups does not work without $wgLDAPRequiredGroups. I suspect that the getGroups function (first line below the "Find group" section) has to be modified to account for the case when users only specify groups for exclusion. Until that is fixed, one can set $wgLDAPUseLDAPGroups to true, as a work-around.
