Bypass blocking doesn't work for backend groups?

Hi - I searched and didn't find this addressed. I'm preparing to allow users to bypass blocking to (for example) YouTube. I created a group in AD, created a matching group name in the Astaro and specified "remote" authentication. When I place a user in the AD group, and they try to unblock the URL, it gives them "Invalid username and password." However, if I create a matching user on the Astaro and specify "remote" authentication, it lets them log in and bypass the URL. Is there some "trick" to getting groups to do the same thing? I've tried this with the "backend sync" both selected and deselected.
Thanks!