I don't quite understand; why not just put

user:*

on the group?