When restricting job execution at slave to LDAP groupID via job restriction plugin, one needs to set additional "slave/build" permission for the user in the global role.
For the "slave/connect" and "slave/disconnect" permission this is not needed, here it is enough to assign this via a slave role.