This remains an issue for me, and sadly, has become a little bit more pressing as there is
some need for some new groups. I found this thread from the past, although I don't
know how applicable it is anymore:
https://freeipa-users.redhat.narkive.com/9EBwEuXO/freeipa-as-a-password-b...