The design here is to intersect multiple groups of unions that are easy to setup and dont pollute the namespace with tons of intermediate groups
Sample data
Add the groups, some memberships, and the attributes
import edu.internet2.middleware.grouper.*; import edu.internet2.middleware.grouper.attr.*; import edu.internet2.middleware.grouper.attr.assign.*; import edu.internet2.middleware.grouper.attr.finder.*; GrouperSession grouperSession = GrouperSession.startRootSession(); new GroupSave(grouperSession).assignName("ref:employee:orgUnitCodes:orgUnitCode_180101").assignCreateParentStemsIfNotExist(true).save(); new GroupSave(grouperSession).assignName("ref:employee:orgUnitCodes:orgUnitCode_123456").save(); new GroupSave(grouperSession).assignName("ref:employee:orgUnitCodes:orgUnitCode_234567").save(); new GroupSave(grouperSession).assignName("ref:employee:orgUnitCodes:orgUnitCode_345678").save(); addMember("ref:employee:orgUnitCodes:orgUnitCode_180101", "test.subject.0"); addMember("ref:employee:orgUnitCodes:orgUnitCode_123456", "test.subject.0"); addMember("ref:employee:orgUnitCodes:orgUnitCode_234567", "test.subject.0"); addMember("ref:employee:orgUnitCodes:orgUnitCode_180101", "test.subject.1"); addMember("ref:employee:orgUnitCodes:orgUnitCode_123456", "test.subject.1"); addMember("ref:employee:orgUnitCodes:orgUnitCode_234567", "test.subject.1"); addMember("ref:employee:orgUnitCodes:orgUnitCode_345678", "test.subject.1"); addMember("ref:employee:orgUnitCodes:orgUnitCode_180101", "test.subject.2"); new GroupSave(grouperSession).assignName("ref:employee:jobClasses:jobClass_EFX").assignCreateParentStemsIfNotExist(true).save(); new GroupSave(grouperSession).assignName("ref:employee:jobClasses:jobClass_ABC").save(); new GroupSave(grouperSession).assignName("ref:employee:jobClasses:jobClass_DEF").save(); new GroupSave(grouperSession).assignName("ref:employee:jobClasses:jobClass_EFG").save(); addMember("ref:employee:jobClasses:jobClass_EFX", "test.subject.0"); addMember("ref:employee:jobClasses:jobClass_ABC", "test.subject.0"); addMember("ref:employee:jobClasses:jobClass_DEF", "test.subject.0"); addMember("ref:employee:jobClasses:jobClass_EFX", "test.subject.1"); addMember("ref:employee:jobClasses:jobClass_ABC", "test.subject.1"); addMember("ref:employee:jobClasses:jobClass_DEF", "test.subject.1"); addMember("ref:employee:jobClasses:jobClass_EFG", "test.subject.1"); addMember("ref:employee:jobClasses:jobClass_EFX", "test.subject.2"); new GroupSave(grouperSession).assignName("ref:employee:jobCodes:jobCode_C902IT").assignCreateParentStemsIfNotExist(true).save(); new GroupSave(grouperSession).assignName("ref:employee:jobCodes:jobCode_B32931").save(); new GroupSave(grouperSession).assignName("ref:employee:jobCodes:jobCode_A46192").save(); addMember("ref:employee:jobCodes:jobCode_C902IT", "test.subject.0"); addMember("ref:employee:jobCodes:jobCode_B32931", "test.subject.0"); addMember("ref:employee:jobCodes:jobCode_C902IT", "test.subject.1"); addMember("ref:employee:jobCodes:jobCode_B32931", "test.subject.1"); addMember("ref:employee:jobCodes:jobCode_A46192", "test.subject.1"); addMember("ref:employee:jobCodes:jobCode_C902IT", "test.subject.2"); AttributeDef attributeDef = new AttributeDefSave(grouperSession).assignName("attr:employeeIntersectDef").assignCreateParentStemsIfNotExist(true).assignCreateParentStemsIfNotExist(true).assignToGroup(true).assignAttributeDefType(AttributeDefType.attr).assignMultiAssignable(false).assignMultiValued(false).assignValueType(AttributeDefValueType.marker).save(); AttributeDef attributeValueDef = new AttributeDefSave(grouperSession).assignName("attr:employeeIntersectValueDef").assignCreateParentStemsIfNotExist(true).assignToGroupAssn(true).assignAttributeDefType(AttributeDefType.attr).assignMultiAssignable(false).assignMultiValued(true).assignValueType(AttributeDefValueType.string).save(); attributeDef.getAttributeDefActionDelegate().configureActionList("assign"); attributeValueDef.getAttributeDefActionDelegate().configureActionList("assign"); employeeIntersect = new AttributeDefNameSave(grouperSession, attributeDef).assignName("attr:employeeIntersect").assignCreateParentStemsIfNotExist(true).assignDisplayName("attr:employeeIntersect").save(); attributeValueDef.getAttributeDefScopeDelegate().assignOwnerNameEquals("attr:employeeIntersect"); jobClass = new AttributeDefNameSave(grouperSession, attributeValueDef).assignName("attr:jobClass").assignCreateParentStemsIfNotExist(true).assignDisplayName("attr:jobClass").save(); jobCode = new AttributeDefNameSave(grouperSession, attributeValueDef).assignName("attr:jobCode").assignCreateParentStemsIfNotExist(true).assignDisplayName("attr:jobCode").save(); orgUnitCode = new AttributeDefNameSave(grouperSession, attributeValueDef).assignName("attr:orgUnitCode").assignCreateParentStemsIfNotExist(true).assignDisplayName("attr:orgUnitCode").save(); Group someList1 = new GroupSave(grouperSession).assignName("app:emailLists:someList1").assignCreateParentStemsIfNotExist(true).save(); attributeAssignSave = new AttributeAssignSave(grouperSession).assignAttributeAssignType(AttributeAssignType.group).assignAttributeDefName(employeeIntersect).assignOwnerGroup(someList1); attributeAssignOnAssignSave = new AttributeAssignSave(grouperSession).assignAttributeAssignType(AttributeAssignType.group_asgn).assignAttributeDefName(jobClass).addValue("EFX").addValue("ABC").addValue("DEF"); attributeAssignSave.addAttributeAssignOnThisAssignment(attributeAssignOnAssignSave); attributeAssignOnAssignSave = new AttributeAssignSave(grouperSession).assignAttributeAssignType(AttributeAssignType.group_asgn).assignAttributeDefName(jobCode).addValue("C902IT").addValue("B32931"); attributeAssignSave.addAttributeAssignOnThisAssignment(attributeAssignOnAssignSave); attributeAssignOnAssignSave = new AttributeAssignSave(grouperSession).assignAttributeAssignType(AttributeAssignType.group_asgn).assignAttributeDefName(orgUnitCode).addValue("123456").addValue("180101"); attributeAssignSave.addAttributeAssignOnThisAssignment(attributeAssignOnAssignSave); attributeAssignSave.save(); Group someList2= new GroupSave(grouperSession).assignName("app:emailLists:someList2").assignCreateParentStemsIfNotExist(true).save(); attributeAssignSave = new AttributeAssignSave(grouperSession).assignAttributeAssignType(AttributeAssignType.group).assignAttributeDefName(employeeIntersect).assignOwnerGroup(someList2); attributeAssignOnAssignSave = new AttributeAssignSave(grouperSession).assignAttributeAssignType(AttributeAssignType.group_asgn).assignAttributeDefName(jobClass).addValue("EFX").addValue("ABC").addValue("EFG"); attributeAssignSave.addAttributeAssignOnThisAssignment(attributeAssignOnAssignSave); attributeAssignOnAssignSave = new AttributeAssignSave(grouperSession).assignAttributeAssignType(AttributeAssignType.group_asgn).assignAttributeDefName(jobCode).addValue("C902IT").addValue("A46192"); attributeAssignSave.addAttributeAssignOnThisAssignment(attributeAssignOnAssignSave); attributeAssignOnAssignSave = new AttributeAssignSave(grouperSession).assignAttributeAssignType(AttributeAssignType.group_asgn).assignAttributeDefName(orgUnitCode).addValue("234567").addValue("345678"); attributeAssignSave.addAttributeAssignOnThisAssignment(attributeAssignOnAssignSave); attributeAssignSave.save();