move user and group management into its own recipe