private void synchronizeGroups(UnixUser unixUser, UserEntity userEntity) {
    LOG.debug("Synchronizing groups for PAM user: {}", unixUser.getUserName());

    Users users = getUsers();

    try {
      //Get all the groups that user belongs to
      //Change all group names to lower case.
      Set<String> unixUserGroups = convertToLowercase(unixUser.getGroups());

      // Add the user to the specified groups, create the group if needed...
      for (String group : unixUserGroups) {
        GroupEntity groupEntity = users.getGroupEntity(group, GroupType.PAM);
        if (groupEntity == null) {
          LOG.info("Synchronizing groups for {}, adding new PAM group: {}", userEntity.getUserName(), group);
          groupEntity = users.createGroup(group, GroupType.PAM);
        }

        if (!users.isUserInGroup(userEntity, groupEntity)) {
          LOG.info("Synchronizing groups for {}, adding user to PAM group: {}", userEntity.getUserName(), group);
          users.addMemberToGroup(groupEntity, userEntity);
        }
      }

      // Remove the user from any other PAM-specific group that the user may have been previously
      // added to. If the user belongs to non-PAM-specific groups, do not alter those assignments.
      Set<MemberEntity> memberEntities = userEntity.getMemberEntities();
      if (memberEntities != null) {
        Collection<GroupEntity> groupsToRemove = new ArrayList<>();
        // Collect the groups to remove...
        for (MemberEntity memberEntity : memberEntities) {
          GroupEntity groupEntity = memberEntity.getGroup();
          if ((groupEntity.getGroupType() == GroupType.PAM) && !unixUserGroups.contains(groupEntity.getGroupName())) {
            groupsToRemove.add(groupEntity);
          }
        }

        // Perform the removals...
        for(GroupEntity groupEntity :groupsToRemove) {
          LOG.info("Synchronizing groups for {}, removing user from PAM group: {}", userEntity.getUserName(), groupEntity.getGroupName());
          users.removeMemberFromGroup(groupEntity, userEntity);
        }
      }
    } catch (AmbariException e) {
      e.printStackTrace();
    }
  }
Synchornizes the OS-level groups assigned to the OS-level user with the groups assigned to the
Ambari user in Ambari

@param unixUser   the user
@param userEntity the ambari user
ambari-server/src/main/java/org/apache/ambari/server/security/authentication/pam/AmbariPamAuthenticationProvider.java