[xwiki-users] Allow Active Directory user to edit his profile only?

I have integrated xwiki with active directory it works great. I want user should be able to edit their profile only not anybody else. Now if i give Admin rights on Xwiki space to XwikiAllGroup, active directory user can edit any user profile and lot of other stuff under xwiki space which i do not want. If i don't give Admin rights on Xwiki space to XwikiAllGroup, in that case user can not edit his profile also. So whats the right way to configure so that user can edit his profile only?