[SSSD] users can't see secondary groups