[Freeipa-users] Confused by the default group permissions