Implement #858 : split user assignment and group rights.