Add the allowed_users configuration for service accounts to bypass the group membership check
    
    This is required for monitoring use-cases, where we can have a Kerberos principal for a
    service account but no associated account in LDAP to check group membership.