Ok, after some testing I got this:

- the first group listed under security(server instance) is used for language

- an other group is used to map the domain group to the...