Thread:Extension talk:LDAP Authentication/RequiredGroups without DN/reply

It looks like the checkGroups function only uses userLDAPGroups["dn"], but it could use userLDAPGroups["short"] when $wgLDAPGroupsUseMemberOf = false.