groups and domains are handled through direct population in user object