Suggestion:
Instead of relying on the daily tomcat restart, it could be good to have a scheduled task that is active by default in Ametys to wipe the different LDAP group caches (for example maybe every hour?)