Hi!
I've noticed that if a user is not part of the allowed LDAP groups and tries to log-in, the user still gets created as a local account in Grav's backend. This occurs when the "Save Grav user" option is enabled., which seems to be necessary for correct permission mapping (view issue #33).
This should not happen when a user fails to log-in, as the "Save Grav user" info states that it "Saves the logged in user as a local Grav account". The user should only be added as a local account after a successful login.