Check the extId as well as id for userGroup.

Reason is that user groups have autogenerated id and if the usergroup is from external source like ldap then the id in the ldap != id in the database so external id is needed for comparison.