# Group (computing) > Mediated Wiki article. Canonical URL: https://mediated.wiki/source/Group_(computing) > Markdown URL: https://mediated.wiki/source/Group_(computing).md > Source: https://en.wikipedia.org/wiki/Group_(computing) > Source revision: 1328531799 > License: Creative Commons Attribution-ShareAlike 4.0 International (https://creativecommons.org/licenses/by-sa/4.0/) {{short description|Grouping of users as part of an access control system on a computer}} {{Use American English |date=January 2024}} {{Use mdy dates |date=January 2024}} {{More citations needed|date=January 2024}} In computing, the term '''group''' generally refers to a grouping of [users](/source/User_(computing)). In principle, users may belong to none, one, or many groups (although in practice some systems place limits on this). The primary purpose of user groups is to simplify [access control](/source/Access_control) to [computer](/source/computer) systems. For instance, a computer science department has a [network](/source/Computer_network) which is shared by [student](/source/student)s and [academics](/source/Academic_staff). The department has made a list of [directories](/source/Directory_(file_systems)) which the students are permitted to access and another list of [directories](/source/Directory_(computing)) which the staff are permitted to access. Without groups, [administrator](/source/System_administrator)s would give each student permission to every student directory, and each staff member permission to every staff directory. In practice, that would be very impractical – every time a student or staff member arrived, administrators would have to allocate permissions on every directory. With groups, the task is much simpler: create a student group and a staff group, placing each user in the proper group. The entire group can be granted access to the appropriate [directory](/source/Directory_(computing)). To add or remove an [account](/source/User_(computing)), one must only need to do it in one place (in the definition of the group), rather than on every [directory](/source/Directory_(computing)). This workflow provides clear separation of concerns: to change access policies, alter the directory permissions; to change the individuals which fall under the policy, alter the group definitions. ==Uses of groups== The primary uses of groups are: * [Access control](/source/Access_control) * Accounting - allocating shared resources like disk space and [network bandwidth](/source/Bandwidth_(computing)) * Default per-user configuration profiles - e.g., by default, every staff account could have a specific directory in their [PATH](/source/Path_(variable)) * Content selection - only display content relevant to group members - e.g. this portal channel is intended for students, this [mailing list](/source/mailing_list) is for the [chess](/source/chess) club ==Delegable group administration== Many systems provide facilities for delegation of group administration. In these systems, when a group is created, one or more users may be named as group administrators. These group administrators are then capable of adding and removing other users from the group, without relying on a system administrator. Some systems also provide joinable groups, which are groups to which users may elect to add themselves. Joinable groups are not intended to be used for access control, but rather for such purposes as [electronic mailing lists](/source/electronic_mailing_lists). ==Static vs. dynamic groups== Many systems (especially [LDAP](/source/Lightweight_Directory_Access_Protocol) systems) offer the facility of dynamic groups. Traditionally groups are static: one defines a group by individually selecting its members. In dynamic groups, however, an administrator can specify search criteria. All users which match the search criteria will be considered a member of this dynamic group. For example, one might build an LDAP directory using source data from a student administration system. The student system could provide an attribute ''degreeCode'', which might be a numeric code identifying the [degree](/source/academic_degree) program in which the student is enrolled. Suppose then that degreeCode 55 is [Bachelor of Computer Science](/source/Bachelor_of_Computer_Science). We could then define a group "BCS-Students" as "(degreeCode=55)" – having defined the group, we do not need to manually modify its membership – its membership will change automatically as updates flow through the system. One can construct even more complex definitions: "BCS-Students-1" could be "(&(degreeCode=55)(enrollmentYear=1))" (meaning: a user is a member of the 'BCS-Students-1' group if it's true they're enrolled in the BSC Computer Science degree program and they're in their first year – i.e., Computer Science [freshmen](/source/First_year)). ==Roles== Some systems (e.g. [Sun](/source/Sun)/[Netscape](/source/Netscape)/[iPlanet](/source/iPlanet) LDAP servers) distinguish between groups and roles. These concepts are mostly equivalent: the main difference is that with a group, its membership is stored as an attribute of the group; whereas with roles, the membership is stored within the users, as a list of roles they belong to. The difference is essentially one of performance trade-offs, in terms of which type of access will be faster: the process of enumerating the membership of a given collection (faster for groups), or the process of enumerating which collections this user belongs to (faster for roles). ==See also== * {{annotated link|Group (database)}} * {{annotated link|Group identifier (Unix)}} == References == {{cite web |title=How to manage users and groups in Linux |first=Damon |last=Garn |date=2021-10-14 |website=Red Hat |url=https://www.redhat.com/sysadmin/linux-user-group-management |access-date=2024-01-29 }} {{DEFAULTSORT:Group (Computing)}} Category:Identity management --- Adapted from the Wikipedia article [Group (computing)](https://en.wikipedia.org/wiki/Group_(computing)) by Wikipedia contributors ([contributor history](https://en.wikipedia.org/wiki/Group_(computing)?action=history)). Available under [Creative Commons Attribution-ShareAlike 4.0 International](https://creativecommons.org/licenses/by-sa/4.0/). Changes may have been made.