u-restrict-by-primary-group-only
If you chose to restrict groups, the server will consider a user restricted
if that user is a member of any restricted group, primary or supplementary.
If you would prefer that the server restrict a user only if her primary
group (the one in the /etc/passwd file) is a restricted group,
then set the u-restrict-by-primary-group-only variable to yes.
Examples:
u-restrict-by-primary-group-only=no
u-restrict-by-primary-group-only=yes
Recommendation:
u-restrict-by-primary-group-only=no