$ 0 0 Nested groups should also be added in the security token. Are all groups in the same domain as the user?