When locking down active directory authentication to only certain AD groups in Linux, it may be necessary to support a group name with spaces in it. Single and double quotes don’t work. Backslashes don’t work. For whatever reason, PAM chose to use [square brackets]. For example:
auth requisite pam_succeed_if.so user ingroup [Group Name With Spaces]
Reading:
Social