Virtual groups generated from user attributes

[joesiltberg]

This is for cases when there are no suitable group objects in the data source, instead users have attributes for the groups they're members of.