Group based authZ works fine