```

The search filter must use the username or the DN to find the user's groups. This is done via [variable substitution](#variable-substitution-in-configuration-strings).

A group's DN may be associated with an [access policy](#managing-usergroup-access-policy).

#### Nested groups usage in LDAP/AD
If you are using Active directory with nested groups you have to add LDAP_MATCHING_RULE_IN_CHAIN: :1.2.840.113556.1.4.1941: to your query.

        // Test with multiple groups
        testUser.setGroupNames(new String[] { "developers", "testers", "managers" });
        groups = fessUserBean.getGroups();
        assertEquals(3, groups.length);
        assertEquals("developers", groups[0]);
        assertEquals("testers", groups[1]);
        assertEquals("managers", groups[2]);
    }

    public void test_isEditable() {
        // Test with non-editable user (default)

	for member, groups := range c.iamUserGroupMemberships {
		if !groups.Contains(group) {
			continue
		}
		groups.Remove(group)
		c.iamUserGroupMemberships[member] = groups
	}
}

func (c *iamCache) policyDBGetGroups(store *IAMStoreSys, userPolicyPresent bool, groups ...string) ([]string, error) {
	var policies []string
	for _, group := range groups {

  @CanIgnoreReturnValue
  public RelationshipTester<T> addRelatedGroup(Iterable<? extends T> group) {
    groups.add(ImmutableList.copyOf(group));
    return this;
  }

  public void test() {
    for (int groupNumber = 0; groupNumber < groups.size(); groupNumber++) {
      ImmutableList<T> group = groups.get(groupNumber);
      for (int itemNumber = 0; itemNumber < group.size(); itemNumber++) {

        assertEquals("Should have 2 groups", 2, multiAnnotation.groups().length);
        assertEquals("First group should be TestGroup", TestGroup.class, multiAnnotation.groups()[0]);
        assertEquals("Second group should be AnotherTestGroup", AnotherTestGroup.class, multiAnnotation.groups()[1]);

        assertEquals("Should have 2 payloads", 2, multiAnnotation.payload().length);

        // Test with empty groups
        groups = new String[] {};
        user = new TestFessUser("testuser", new String[] {}, groups, new String[] {});
        assertArrayEquals(groups, user.getGroupNames());

        // Test with null groups
        user = new TestFessUser("testuser", new String[] {}, null, new String[] {});
        assertNull(user.getGroupNames());

        // Test with groups containing spaces

            }
        };

        assertEquals("Should have 2 groups", 2, multiAnnotation.groups().length);
        assertEquals("First group should be TestGroup", TestGroup.class, multiAnnotation.groups()[0]);
        assertEquals("Second group should be AnotherTestGroup", AnotherTestGroup.class, multiAnnotation.groups()[1]);

        assertEquals("Should have 2 payloads", 2, multiAnnotation.payload().length);

    /**
     * Constructs a PAC group entry.
     * @param id the group's Security Identifier (SID)
     * @param attributes the group membership attributes
     */
    public PacGroup(final SID id, final int attributes) {
        this.id = id;
        this.attributes = attributes;
    }

    /**
     * Returns the group's Security Identifier.
     * @return the group SID
     */
    public SID getId() {

  @CanIgnoreReturnValue
  public RelationshipTester<T> addRelatedGroup(Iterable<? extends T> group) {
    groups.add(ImmutableList.copyOf(group));
    return this;
  }

  public void test() {
    for (int groupNumber = 0; groupNumber < groups.size(); groupNumber++) {
      ImmutableList<T> group = groups.get(groupNumber);
      for (int itemNumber = 0; itemNumber < group.size(); itemNumber++) {

            // Groups data
            PacGroup[] groups = {};
            if (groupPointer != 0) {
                final int realGroupCount = pacStream.readInt();
                if (realGroupCount != groupCount) {
                    throw new PACDecodingException("Invalid number of groups in PAC expect" + groupCount + " have " + realGroupCount);
                }