09dd05b
Make activated/inactivated groups optional directly change nsAccountLock on the entry if they are not used Fixes: https://fedorahosted.org/freeipa/ticket/1021