```

The search filter must use the username or the DN to find the user's groups. This is done via [variable substitution](#variable-substitution-in-configuration-strings).

A group's DN may be associated with an [access policy](#managing-usergroup-access-policy).

#### Nested groups usage in LDAP/AD
If you are using Active directory with nested groups you have to add LDAP_MATCHING_RULE_IN_CHAIN: :1.2.840.113556.1.4.1941: to your query.

    "groups" : [ {
      "testProject" : "largeEmptyMultiProjectDeclarativeDsl",
      "coverage" : {
        "per_day" : [ "linux", "macOs", "windows" ]
      }
    } ]
  }, {
    "testId" : "org.gradle.performance.experiment.declarativedsl.DeclarativeDslFirstUsePerformanceTest.cold daemon",
    "groups" : [ {
      "testProject" : "largeEmptyMultiProjectDeclarativeDsl",

        // Test with multiple groups
        testUser.setGroupNames(new String[] { "developers", "testers", "managers" });
        groups = fessUserBean.getGroups();
        assertEquals(3, groups.length);
        assertEquals("developers", groups[0]);
        assertEquals("testers", groups[1]);
        assertEquals("managers", groups[2]);
    }

    @Test
    public void test_isEditable() {

        assertEquals("Should have 2 groups", 2, multiAnnotation.groups().length);
        assertEquals("First group should be TestGroup", TestGroup.class, multiAnnotation.groups()[0]);
        assertEquals("Second group should be AnotherTestGroup", AnotherTestGroup.class, multiAnnotation.groups()[1]);

        assertEquals("Should have 2 payloads", 2, multiAnnotation.payload().length);

        // Test with empty groups
        groups = new String[] {};
        user = new TestFessUser("testuser", new String[] {}, groups, new String[] {});
        assertArrayEquals(groups, user.getGroupNames());

        // Test with null groups
        user = new TestFessUser("testuser", new String[] {}, null, new String[] {});
        assertNull(user.getGroupNames());

        // Test with groups containing spaces

            }
        };

        assertEquals("Should have 2 groups", 2, multiAnnotation.groups().length);
        assertEquals("First group should be TestGroup", TestGroup.class, multiAnnotation.groups()[0]);
        assertEquals("Second group should be AnotherTestGroup", AnotherTestGroup.class, multiAnnotation.groups()[1]);

        assertEquals("Should have 2 payloads", 2, multiAnnotation.payload().length);

            // Groups data
            PacGroup[] groups = {};
            if (groupPointer != 0) {
                final int realGroupCount = pacStream.readInt();
                if (realGroupCount != groupCount) {
                    throw new PACDecodingException("Invalid number of groups in PAC expect" + groupCount + " have " + realGroupCount);
                }

)

// ListLDAPPolicyMappingEntities lists users/groups mapped to given/all policies.
//
// GET <admin-prefix>/idp/ldap/policy-entities?[query-params]
//
// Query params:
//
//	user=... -> repeatable query parameter, specifying users to query for
//	policy mapping
//
//	group=... -> repeatable query parameter, specifying groups to query for
//	policy mapping
//

			AccountName:     cred.AccessKey,
			Groups:          cred.Groups,
			Action:          policy.BypassGovernanceRetentionAction,
			BucketName:      bucketName,
			ObjectName:      objectName,
			ConditionValues: conditions,
			IsOwner:         owner,
			Claims:          cred.Claims,
		})
	}
	if globalIAMSys.IsAllowed(policy.Args{
		AccountName:     cred.AccessKey,
		Groups:          cred.Groups,

		}
	}

	groups, err := l.LDAP.SearchForUserGroups(conn, shortUsername, lookupRes.ActualDN)
	if err != nil {
		return nil, nil, err
	}
	return lookupRes, groups, nil
}

// Bind - binds to ldap, searches LDAP and returns the distinguished name of the
// user and the list of groups.