[Freeipa-users] Would like to set up a "least privilege" admin only capable of managing POSIX groups, not users.