kerberos auth info3 should contain resource group ids available from pac_logon