In ticket #3813 we allow external system to manage user life cycle. In other ticket #3911 we allow external system to manage IPA user via LDAP. What is missing is the way for the external system to manage groups and user membership via LDAP.

1. We need to see if we can just advise people to create groups via LDAP. If not we probably need to allow something similar to staging for groups. May be external system will create LDAP entries in the same staging area that will be then properly converted?
2. We need to figure out how external system would be able to add/remove users from groups.

There are some IAM systems (Oracle, IBM) that do the group and group membership management so we need to cover that part too.