OneM2M Authentication Server

Question

I'm working on IoTKETI Mobius platform. I try to implement group-based authentication methods in oneM2M, Mobius platform. I was able to Register, Update, Delete an Application Entity. I did not use access control policies yet, because of my main aim is group-based authentication i thought that i should use an external authentication server. I did my research in onem2m documents, however i couldn't find any direct answer. Is there a way that, implement group-based authentication in IoTKETI Mobius ? Do i need external authentication server or it can be done with acp ? If authencation server needed, which one should i research ?