[Freeipa-users] anyone know how to do sssd filters?

[KodaK]

I'm attempting to install Satellite in my IPA domain.  There is a
ridiculous requirement that the group "dba" must not already exist
prior to installing.  Red Hat support wanted me to *remove* the DBA
group and then install.

Anyway, I'm trying to play around with filter_groups in sssd, and I
can't seem to get it to "take."  The man page isn't exactly clear, but
here's what I've tried:

filter_groups = dba
filter_groups= dba at fqdn

In the [domain], [sssd] and [nss] sections of the config file.

What's the right syntax?  Do I need it in every section?

-- 
The government is going to read our mail anyway, might as well make it
tough for them.  GPG Public key ID:  B6A1A7C6