Groups › Create a Nested Group

Create a Nested Group

If the user store is an LDAP directory, you can add a group as a member of another group. The group is called a nested group.

The group containing the nested group is called a parent group. Members of the nested group become members of the parent group. However, members of the parent group do not become members of a nested group.

Nested groups are similar to email distribution lists where one list can be a member of another. With nested groups, you can add groups and users as members in the group. By nesting a group in another group's membership list, you could include all nested groups members.

For example, if you created separate groups for the manufacturing, design, shipping, and accounting divisions of a company, you can construct a parent group for the entire company by nesting all the separate division groups as members of the company parent group. As a result, any changes you made to the manufacturing, design, shipping, and accounting nested groups would be automatically reflected in the nested group for the entire company. A group that is nested within another group can be dynamic and/or contain other nested groups.

The figure in Static, Dynamic, and Nested Groups Example shows a parent group created by static, dynamic, and nested groups.

Be aware of the following before creating a nested group:

• Only an administrator with the Modify Group Members task can add or change nested groups from the group’s static member list in the User Console.
• Only users with the appropriate administrator privileges can modify, add, or remove members from a group.

  For example, if parent Group A is created by nested groups B and C, the Group A administrator can only modify the members of Group A and not B and C. Groups B and C can only be modified by their appropriate administrators.

• To enable nested groups, system administrators configure nested group support in the directory configuration file (directory.xml):
  • Add the GroupTypes element in the Directory Groups Behavior section as follows:

    <GroupTypes type=type>

    type can be NESTED, DYNAMIC, or ALL.

    GroupTypes is case-sensitive.

  • Map the %NESTED_GROUP_MEMBERSHIP% well-known attribute to a physical attribute that exists in the user store.

To create a nested group:

1. In the User Console, select Groups, Create Group.
2. Choose to create a new group or a copy of a group and click OK.
3. On the Profile tab, enter a group name, group organization, description, and group administrator name.
4. On the Membership tab:
   1. Click Add a group to add a nested group to this group.
   2. Search for an existing group.
   3. Put a check next to the group and click Select.
   4. Click Submit.