s3:auth make sure the primary group sid is usable