permissions: add permissions for read and mod of external group members

Issue: "User Administrator" role cannot add users to an External Group.

https://fedorahosted.org/freeipa/ticket/5504

Reviewed-By: Martin Basti <mbasti@redhat.com>

ipaserver/plugins/group.py

@@ -194,6 +194,13 @@ class group(LDAPObject):
                 'member', 'memberof', 'memberuid', 'memberuser', 'memberhost',
             },
         },
+        'System: Read External Group Membership': {
+            'ipapermbindruletype': 'all',
+            'ipapermright': {'read', 'search', 'compare'},
+            'ipapermdefaultattr': {
+                'ipaexternalmember',
+            },
+        },
         'System: Add Groups': {
             'ipapermright': {'add'},
             'replaces': [
@@ -216,6 +223,16 @@ class group(LDAPObject):
                 'Group Administrators', 'Modify Group membership'
             },
         },
+        'System: Modify External Group Membership': {
+            'ipapermright': {'write'},
+            'ipapermtargetfilter': [
+                '(objectclass=ipaexternalgroup)',
+            ],
+            'ipapermdefaultattr': {'ipaexternalmember'},
+            'default_privileges': {
+                'Group Administrators', 'Modify Group membership'
+            },
+        },
         'System: Modify Groups': {
             'ipapermright': {'write'},
             'ipapermdefaultattr': {