'Returns True if the negative group requirement (AUTH_LDAP_DENY_GROUP)
is met. Always returns True if AUTH_LDAP_DENY_GROUP is None.'

def _check_denied_group(self):

    denied_group_dn = self.settings.DENY_GROUP
    if (denied_group_dn is not None):
        is_member = self._get_groups().is_member_of(denied_group_dn)
        if is_member:
            raise self.AuthenticationFailed('User    is    a    member    of    AUTH_LDAP_DENY_GROUP')
    return True
