allow the unix group in a mapping to be changed; doesn't work with LDAP right now...