When Confluence is integrated with Active Directory, LDAP users that don't have "Domain User" set as their primary group can not connect to Confluence. For exemple, let's say we want to have users in LDAP that can just use Confluence and do nothing else, we'll create them with a single group (thus set as their primary group) actually allowed to get access to Confluence resources. In that case, they are unable to connect and are not shown as member of the group in Confluence.