Don't create private groups for migrated users, check for valid gidnumber
    
    Migrated users don't get a private group, there is no safe way to verify
    that the namespace is correct without redoing the uidnumber as well.
    
    Verify that the GID at least points to a valid group on the remote server
    and warn if it doesn't (this doesn't guarantee that the group gets migrated
    but at least we try).
    
    If the remote entry has no gidNumber then don't migrate that user. We
    don't know why that user is non-POSIX, it could be a special user used
    for auth, for example.
    
    Add a loginshell if the remote user doesn't have one.
    
    https://fedorahosted.org/freeipa/ticket/2562