limit_except per ad group?

Hello,
I want to limit access to a server via nginx. Therefore I want to have 2 AD groups: one with user allowed to read (use GET) and one with people to write (POST and PUT )
What I already found is the limit_except directive, but I see only a way to enable basic authentication.
Is this possible with a kerberos authentication user? (authentication in general is already working)

What I thin about is something like:
limit_except POST PUT HEAD GET{
allow auth_gss_authorized_group group1 ;
deny all;
};
limit_except HEAD GET {

allow auth_gss_authorized_group group2 ;
deny all;
};