IPA-style netgroups from bug #498432, initial