Seems wrong to be hard-coding IDs here (and below).
conn.getAdminService().getSecurityRoles().systemGroupId  and .userGroupId is nicer