ldap auth not setting %{session.ldap.last.attr.dn}

Have you tried adding "dn" in required attribute under LDAP query properties? Alternatively, you can try with

"session.ldap.last.attr.memberOf" variable and works great to identify the group membership.

Below is the expression to check for the group membership -

expr {[string match -nocase {*group_name*} [mcget {session.ad.last.attr.memberOf}]] }