Carnegie Mellon University
Office of the CIO  ›  Computing Services  ›  Services  ›  Security Services  ›  Identity and Access Management  ›  Group Management  ›  How to Use Grouper  ›  Work with Composite Groups

Work with Composite Groups

Grouper allows you to use two existing groups (factors) to define a third (composite) group. You may combine two groups in the following ways:

  • INTERSECTION - includes all members of two original (factor) groups. For example, Group Z contains members of both Group X AND Group Y
  • COMPLEMENT - includes entities that belong to the primary factor group who are not also members of the secondary factor group. For example, Group Z contains members of Group X NOT Group Y
grouper

Example
The all-users composite group establishes access to a service owner's application. It has two members/groups:

  • users-allow (factor 1) - LDAP manages members from a Community Population (for example, all faculty).
  • users-deny (factor 2) - Service owner manages members in Grouper.

Using the Complement (NOT) operation, the service owner can add members to the users-deny group to prevent access to the application, and remove members from the users-deny group when access is granted, without having to manage the Community Population. 

To Create a Composite Group

  1. Create a group and enter a Group name and Description.
  2. From the group’s page, select More actions > Edit composite.
  3. Click Yes to open the composite window.
  4. Enter a group name or ID as the First factor group.
  5. Select the Operation of choice based on how you want to combine the groups:
    • And = intersection 
    • Not = complement 
  6. Enter a group name or ID as the Second factor group.
  7. Click Save.