The group editing page in the admin console is not very intuitive as-is. Particularly, the 'shared group' settings confuse me, as well as errors that imply that these settings cannot be changed for read-only group providers (like LDAP), while in reality, you can have shared groups with LDAP.