Doesn't puppet do that already? Doesn't it manage ...
# puppet
b
Doesn't puppet do that already? Doesn't it manage all group memberships?