Grouper allows you to use two existing groups to define a third group. The two groups are referred to as the First Factor Group and the Second Factor Group.
The third group is a composite of the other two groups. The First and Second Factor Groups can be combined as a complement or intersection.
Complement includes members of the first factor group who are not also members of the second factor group. Complements are often used for managing access: the first factor group representing an allow group, and the second factor group representing a deny group.
In the image below, the complement would be the yellow region on the left labeled A.
Intersection includes only those entities that belong to both of the factor groups. Intersection groups are often used when creating reference groups from basis groups.
In the image below, the intersection would be the purple region labeled A∩B.
Assume two groups
- Group A
- Goldy
- Pounce
- Regal
- Group B
- Pounce
- Regal
- Champ
Complement (NOT): Group A complement Group B results in {Goldy}, since Goldy is the only one in Group A but NOT in Group B.
Note that the order of groups matter. If it were Group B complement Group A, the result would be {Champ}, since Champ is the only one in Group B that is NOT in Group A.
Intersection (AND) Example: Group A intersection Group B would result in {Pounce, Regal}, since Pounce and Regal are the only ones in Group A AND Group B.
There is a third type of composite group called Union, which is all of Group A and all of Group B. To create a union, just add both groups to the group.
Important notes:
- The user setting up the composite group must have the read privilege for both factor groups and have the update privilege of the overall group.
- The overall group must be empty of members when a composite group is configured.
- A composite group cannot have direct members.
- There cannot be a composite of three groups.