Allow lookup of groups directly from user object

Also add Microsoft Active directory specific lookup logic to resolve
nested groups.