OpenLDAP User Login Control?

Ldap Server is OpenLDAP

i’m trying to setup a user filter to only allow users that are assinged to a certain group access to the Openfire Server. (we dont want everyone to share in its glory) Below is a short tree of the AD

dc=example,dc=com

|_ou=Users

| |_uid=user1

| |_uid=user2

|_ou=Groups

|_cn=email

|_cn=messenger

Ok so user 1 is bound to group email and messenger by the group config below

cn:email

objectClass: posixGroup

memberUid: user1

memberUid: user2

cn: messenger

objectClass: posixGroup

memberUid: user1

there is no “memberOf” feilds in the users configs.

what kind of a filter should i use to allow user1 to access the messenger (openfire) but not allow user2