LDAP users are able to login until the next LDAP synchronization task is completed, even though the "Filter users by groups" option is enabled and they are not members of any synchronized LDAP group.