We use object class to verify if it is user or group. Your user has classes classes: top,vasco-DPToken, but does not have user or group class(that are defined in your config). It looks like you can use vasco-DPApplication class as a user class. And you should check what class is group class the same way it was done for users.