groups/domains associations within user can have additional attributes