map $ssl_client_s_dn $allow_group_main {
    default "";
    ~CN=Sheppy true;
    ~CN=Kathi true;
}

map $ssl_client_s_dn $allow_group_ths {
    default "";
    ~OU=THS true;
}