LDAP authentication - Dynamic authorization for different groups

Never wanted to say it's an issue, but perhaps LDAP auth can be improved for Gogs.

I have also Dokuwiki setup for same LDAP, for different users, different groups, where users have different permissions according to the groups they belong.

I guess dokuwiki logic for LDAP work as following (https://www.dokuwiki.org/plugin:authldap:openldap#with_anonymous_bind_and_filters):

1. Get list of groups from LDAP
2. Admin belongs in group WikiAdmins
3. On user login, following filter is checked with search base "dc=domain,dc=com":

(&(objectClass=posixGroup)(|(memberUid=[ADMIN_USER_UID])(gidNumber=[ADMIN_GROUP_GID])))

Reponse to this filter is for example as following:

cn=WikiAdmins
dn  cn=WikiAdmins,ou=Groups,dc=domain,dc=com
cn  WikiAdmins

Sample LDAP structure:

domain.com
    Service Accounts (Application Bind Users)
        AppUser
    Admins (Admin accounts)
        AdminUser
    Persons (regular accounts)
        Ted
        Kelly
        Ned
    Groups (Groups to define access level to applications)
        GogsAdmins
            AdminUser
        GogsUsers
            Ted
            Kelly
            Ned

In my opinion, the current LDAP auth handling does not allow dynamic admin groups for administrating diffrent applications..
There are only super admins, which are users, created for example under "ADMINS" group, like it's meant that "Once admin, always admin". No option to have different users with different admin accesses to different applications.

The issue does not name files, tests, or entry points. Start by locating the LDAP authentication handling and the existing super-admin authorization flow, then determine how group membership should map to application-specific permissions. Done means agreeing on the authorization model and implementing dynamic group-based administration with coverage for the supported LDAP scenarios.