diff --git a/ldap_authentication/LdapAuthenticationConf.class.php b/ldap_authentication/LdapAuthenticationConf.class.php
index 7bc11db..c465a8e 100644
--- a/ldap_authentication/LdapAuthenticationConf.class.php
+++ b/ldap_authentication/LdapAuthenticationConf.class.php
@@ -24,6 +24,7 @@ class LdapAuthenticationConf {
   public $apiPrefs = array();
   public $createLDAPAccounts; // should an drupal account be created when an ldap user authenticates
   public $createLDAPAccountsAdminApproval; // create them, but as blocked accounts
+  public $excludeIfNoAuthorizations = LDAP_AUTHENTICATION_EXCL_IF_NO_AUTHZ_DEFAULT;
 
   /**
    * Advanced options.   whitelist / blacklist options
@@ -50,6 +51,7 @@ class LdapAuthenticationConf {
     'allowOnlyIfTextInDn',
     'excludeIfTextInDn',
     'allowTestPhp',
+    'excludeIfNoAuthorizations',
   );
 
   /** are any ldap servers that are enabled associated with ldap authentication **/
@@ -139,14 +141,31 @@ class LdapAuthenticationConf {
      * do one of the allow attribute pairs match
      */
     if (count($this->allowOnlyIfTextInDn)) {
+      $fail = TRUE;
       foreach ($this->allowOnlyIfTextInDn as $test) {
         if (strpos(drupal_strtolower($ldap_user['dn']), drupal_strtolower($test)) !== FALSE) {
-          return TRUE;
+          $fail = FALSE;
         }
       }
-      return FALSE;
+      if ($fail) {
+        return FALSE;
+      }
+
+    }
+    /**
+     * is excludeIfNoAuthorizations option enabled and user not granted any groups
+     */
+
+    if ($this->excludeIfNoAuthorizations) {
+      //@todo:  does the following query account for "only apply to ldap authenticated users?"
+      // if not, there is a stalemate here
+    //  list($authorizations, $notifications) = ldap_authorizations_user_authorizations($name, 'query');
+     // if (count(array_filter(array_values($authorizations))) == 0) {
+    //    return FALSE;
+    //  }
     }
 
+
     /**
      * default to allowed
      */
diff --git a/ldap_authentication/LdapAuthenticationConfAdmin.class.php b/ldap_authentication/LdapAuthenticationConfAdmin.class.php
index 70a0004..a2c8a6e 100644
--- a/ldap_authentication/LdapAuthenticationConfAdmin.class.php
+++ b/ldap_authentication/LdapAuthenticationConfAdmin.class.php
@@ -47,6 +47,12 @@ class LdapAuthenticationConfAdmin extends LdapAuthenticationConf {
         for allowing ldap authentication.  Available variables are:
         $drupal_mapped_username and $user_ldap_entry  See readme.txt for more info.');
 
+    $values['excludeIfNoAuthorizationsDescription'] = t('If the user is not granted any drupal roles,
+      organic groups, etc. by LDAP Authorization, login will be denied.  LDAP Authorization must be
+      enabled for this to work.');
+
+
+
     /**
     * 3. Drupal Account Provisioning and Syncing
     */
@@ -100,6 +106,7 @@ class LdapAuthenticationConfAdmin extends LdapAuthenticationConf {
   protected $ldapUserHelpLinkUrlDescription;
   protected $ldapUserHelpLinkTextDescription;
 
+
   /**
    * 2.  LDAP User Restrictions
    */
@@ -260,6 +267,16 @@ class LdapAuthenticationConfAdmin extends LdapAuthenticationConf {
       '#description' => t($this->allowTestPhpDescription, $tokens),
     );
 
+
+    $form['restrictions']['excludeIfNoAuthorizations'] = array(
+      '#type' => 'checkbox',
+      '#title' => t('Deny access to users without authorization mappings such as Drupal roles.'),
+      '#default_value' =>  $this->excludeIfNoAuthorizations,
+      '#description' => t($this->excludeIfNoAuthorizationsDescription, $tokens),
+      '#disabled' => (boolean)(!module_exists('ldap_authorization')),
+    );
+
+
     $form['drupal_accounts'] = array(
       '#type' => 'fieldset',
       '#title' => t('Drupal User Account Creation'),
@@ -348,6 +365,7 @@ class LdapAuthenticationConfAdmin extends LdapAuthenticationConf {
     $this->acctCreation  = ($values['acctCreation']) ? (int)$values['acctCreation'] : NULL;
     $this->ldapUserHelpLinkUrl = ($values['ldapUserHelpLinkUrl']) ? (string)$values['ldapUserHelpLinkUrl'] : NULL;
     $this->ldapUserHelpLinkText = ($values['ldapUserHelpLinkText']) ? (string)$values['ldapUserHelpLinkText'] : NULL;
+    $this->excludeIfNoAuthorizations = ($values['excludeIfNoAuthorizations']) ? (int)$values['excludeIfNoAuthorizations'] : NULL;
     $this->emailOption  = ($values['emailOption']) ? (int)$values['emailOption'] : NULL;
     $this->emailUpdate  = ($values['emailUpdate']) ? (int)$values['emailUpdate'] : NULL;
 
diff --git a/ldap_authentication/ldap_authentication.module b/ldap_authentication/ldap_authentication.module
index 9ddacff..0b70628 100644
--- a/ldap_authentication/ldap_authentication.module
+++ b/ldap_authentication/ldap_authentication.module
@@ -16,6 +16,7 @@ define('LDAP_AUTHENTICATION_MIXED',        1);
 define('LDAP_AUTHENTICATION_EXCLUSIVE',    2);
 define('LDAP_AUTHENTICATION_MODE_DEFAULT', 1);
 
+define('LDAP_AUTHENTICATION_EXCL_IF_NO_AUTHZ_DEFAULT', 0);
 define('LDAP_AUTHENTICATION_CONFLICT_LOG',             1);
 define('LDAP_AUTHENTICATION_CONFLICT_RESOLVE',         2);
 define('LDAP_AUTHENTICATION_CONFLICT_RESOLVE_DEFAULT', 2);