[380629] Design a default Security model

https://bugs.eclipse.org/bugs/show_bug.cgi?id=380629

10 files changed, 983 insertions, 114 deletions

diff --git a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/Group.java b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/Group.java
index 32f7e31e93..12f7a9acb9 100644
--- a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/Group.java
+++ b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/Group.java
@@ -21,7 +21,10 @@ import org.eclipse.emf.common.util.EList;
  * The following features are supported:
  * <ul>
  *   <li>{@link org.eclipse.emf.cdo.security.Group#getInheritedGroups <em>Inherited Groups</em>}</li>
+ *   <li>{@link org.eclipse.emf.cdo.security.Group#getAllInheritedGroups <em>All Inherited Groups</em>}</li>
  *   <li>{@link org.eclipse.emf.cdo.security.Group#getInheritingGroups <em>Inheriting Groups</em>}</li>
+ *   <li>{@link org.eclipse.emf.cdo.security.Group#getAllInheritingGroups <em>All Inheriting Groups</em>}</li>
+ *   <li>{@link org.eclipse.emf.cdo.security.Group#getAllRoles <em>All Roles</em>}</li>
  *   <li>{@link org.eclipse.emf.cdo.security.Group#getUsers <em>Users</em>}</li>
  * </ul>
  * </p>
@@ -86,4 +89,52 @@ public interface Group extends Assignee
    */
   EList<Group> getInheritingGroups();
 
+  /**
+   * Returns the value of the '<em><b>All Inheriting Groups</b></em>' reference list.
+   * The list contents are of type {@link org.eclipse.emf.cdo.security.Group}.
+   * <!-- begin-user-doc -->
+   * <p>
+   * If the meaning of the '<em>All Inheriting Groups</em>' reference list isn't clear,
+   * there really should be more of a description here...
+   * </p>
+   * <!-- end-user-doc -->
+   * @return the value of the '<em>All Inheriting Groups</em>' reference list.
+   * @see org.eclipse.emf.cdo.security.SecurityPackage#getGroup_AllInheritingGroups()
+   * @model transient="true" changeable="false" volatile="true" derived="true"
+   * @generated
+   */
+  EList<Group> getAllInheritingGroups();
+
+  /**
+   * Returns the value of the '<em><b>All Inherited Groups</b></em>' reference list.
+   * The list contents are of type {@link org.eclipse.emf.cdo.security.Group}.
+   * <!-- begin-user-doc -->
+   * <p>
+   * If the meaning of the '<em>All Inherited Groups</em>' reference list isn't clear,
+   * there really should be more of a description here...
+   * </p>
+   * <!-- end-user-doc -->
+   * @return the value of the '<em>All Inherited Groups</em>' reference list.
+   * @see org.eclipse.emf.cdo.security.SecurityPackage#getGroup_AllInheritedGroups()
+   * @model transient="true" changeable="false" volatile="true" derived="true"
+   * @generated
+   */
+  EList<Group> getAllInheritedGroups();
+
+  /**
+   * Returns the value of the '<em><b>All Roles</b></em>' reference list.
+   * The list contents are of type {@link org.eclipse.emf.cdo.security.Role}.
+   * <!-- begin-user-doc -->
+   * <p>
+   * If the meaning of the '<em>All Roles</em>' reference list isn't clear,
+   * there really should be more of a description here...
+   * </p>
+   * <!-- end-user-doc -->
+   * @return the value of the '<em>All Roles</em>' reference list.
+   * @see org.eclipse.emf.cdo.security.SecurityPackage#getGroup_AllRoles()
+   * @model transient="true" changeable="false" volatile="true" derived="true"
+   * @generated
+   */
+  EList<Role> getAllRoles();
+
 } // Group
diff --git a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/SecurityPackage.java b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/SecurityPackage.java
index b4390870fb..2acaed64c6 100644
--- a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/SecurityPackage.java
+++ b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/SecurityPackage.java
@@ -362,13 +362,40 @@ public interface SecurityPackage extends EPackage
   int GROUP__INHERITED_GROUPS = ASSIGNEE_FEATURE_COUNT + 0;
 
   /**
+   * The feature id for the '<em><b>All Inherited Groups</b></em>' reference list.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   * @ordered
+   */
+  int GROUP__ALL_INHERITED_GROUPS = ASSIGNEE_FEATURE_COUNT + 1;
+
+  /**
    * The feature id for the '<em><b>Inheriting Groups</b></em>' reference list.
    * <!-- begin-user-doc -->
    * <!-- end-user-doc -->
    * @generated
    * @ordered
    */
-  int GROUP__INHERITING_GROUPS = ASSIGNEE_FEATURE_COUNT + 1;
+  int GROUP__INHERITING_GROUPS = ASSIGNEE_FEATURE_COUNT + 2;
+
+  /**
+   * The feature id for the '<em><b>All Inheriting Groups</b></em>' reference list.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   * @ordered
+   */
+  int GROUP__ALL_INHERITING_GROUPS = ASSIGNEE_FEATURE_COUNT + 3;
+
+  /**
+   * The feature id for the '<em><b>All Roles</b></em>' reference list.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   * @ordered
+   */
+  int GROUP__ALL_ROLES = ASSIGNEE_FEATURE_COUNT + 4;
 
   /**
    * The feature id for the '<em><b>Users</b></em>' reference list.
@@ -377,7 +404,7 @@ public interface SecurityPackage extends EPackage
    * @generated
    * @ordered
    */
-  int GROUP__USERS = ASSIGNEE_FEATURE_COUNT + 2;
+  int GROUP__USERS = ASSIGNEE_FEATURE_COUNT + 5;
 
   /**
    * The number of structural features of the '<em>Group</em>' class.
@@ -386,7 +413,7 @@ public interface SecurityPackage extends EPackage
    * @generated
    * @ordered
    */
-  int GROUP_FEATURE_COUNT = ASSIGNEE_FEATURE_COUNT + 3;
+  int GROUP_FEATURE_COUNT = ASSIGNEE_FEATURE_COUNT + 6;
 
   /**
    * The meta object id for the '{@link org.eclipse.emf.cdo.security.impl.UserImpl <em>User</em>}' class.
@@ -435,13 +462,40 @@ public interface SecurityPackage extends EPackage
   int USER__GROUPS = ASSIGNEE_FEATURE_COUNT + 0;
 
   /**
+   * The feature id for the '<em><b>All Groups</b></em>' reference list.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   * @ordered
+   */
+  int USER__ALL_GROUPS = ASSIGNEE_FEATURE_COUNT + 1;
+
+  /**
+   * The feature id for the '<em><b>All Roles</b></em>' reference list.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   * @ordered
+   */
+  int USER__ALL_ROLES = ASSIGNEE_FEATURE_COUNT + 2;
+
+  /**
+   * The feature id for the '<em><b>Label</b></em>' attribute.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   * @ordered
+   */
+  int USER__LABEL = ASSIGNEE_FEATURE_COUNT + 3;
+
+  /**
    * The feature id for the '<em><b>First Name</b></em>' attribute.
    * <!-- begin-user-doc -->
    * <!-- end-user-doc -->
    * @generated
    * @ordered
    */
-  int USER__FIRST_NAME = ASSIGNEE_FEATURE_COUNT + 1;
+  int USER__FIRST_NAME = ASSIGNEE_FEATURE_COUNT + 4;
 
   /**
    * The feature id for the '<em><b>Last Name</b></em>' attribute.
@@ -450,7 +504,7 @@ public interface SecurityPackage extends EPackage
    * @generated
    * @ordered
    */
-  int USER__LAST_NAME = ASSIGNEE_FEATURE_COUNT + 2;
+  int USER__LAST_NAME = ASSIGNEE_FEATURE_COUNT + 5;
 
   /**
    * The feature id for the '<em><b>Email</b></em>' attribute.
@@ -459,7 +513,7 @@ public interface SecurityPackage extends EPackage
    * @generated
    * @ordered
    */
-  int USER__EMAIL = ASSIGNEE_FEATURE_COUNT + 3;
+  int USER__EMAIL = ASSIGNEE_FEATURE_COUNT + 6;
 
   /**
    * The feature id for the '<em><b>Locked</b></em>' attribute.
@@ -468,7 +522,7 @@ public interface SecurityPackage extends EPackage
    * @generated
    * @ordered
    */
-  int USER__LOCKED = ASSIGNEE_FEATURE_COUNT + 4;
+  int USER__LOCKED = ASSIGNEE_FEATURE_COUNT + 7;
 
   /**
    * The feature id for the '<em><b>Password</b></em>' containment reference.
@@ -477,7 +531,7 @@ public interface SecurityPackage extends EPackage
    * @generated
    * @ordered
    */
-  int USER__PASSWORD = ASSIGNEE_FEATURE_COUNT + 5;
+  int USER__PASSWORD = ASSIGNEE_FEATURE_COUNT + 8;
 
   /**
    * The number of structural features of the '<em>User</em>' class.
@@ -486,7 +540,7 @@ public interface SecurityPackage extends EPackage
    * @generated
    * @ordered
    */
-  int USER_FEATURE_COUNT = ASSIGNEE_FEATURE_COUNT + 6;
+  int USER_FEATURE_COUNT = ASSIGNEE_FEATURE_COUNT + 9;
 
   /**
    * The meta object id for the '{@link org.eclipse.emf.cdo.security.impl.UserPasswordImpl <em>User Password</em>}' class.
@@ -719,6 +773,39 @@ public interface SecurityPackage extends EPackage
   EReference getGroup_InheritingGroups();
 
   /**
+   * Returns the meta object for the reference list '{@link org.eclipse.emf.cdo.security.Group#getAllInheritingGroups <em>All Inheriting Groups</em>}'.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @return the meta object for the reference list '<em>All Inheriting Groups</em>'.
+   * @see org.eclipse.emf.cdo.security.Group#getAllInheritingGroups()
+   * @see #getGroup()
+   * @generated
+   */
+  EReference getGroup_AllInheritingGroups();
+
+  /**
+   * Returns the meta object for the reference list '{@link org.eclipse.emf.cdo.security.Group#getAllInheritedGroups <em>All Inherited Groups</em>}'.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @return the meta object for the reference list '<em>All Inherited Groups</em>'.
+   * @see org.eclipse.emf.cdo.security.Group#getAllInheritedGroups()
+   * @see #getGroup()
+   * @generated
+   */
+  EReference getGroup_AllInheritedGroups();
+
+  /**
+   * Returns the meta object for the reference list '{@link org.eclipse.emf.cdo.security.Group#getAllRoles <em>All Roles</em>}'.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @return the meta object for the reference list '<em>All Roles</em>'.
+   * @see org.eclipse.emf.cdo.security.Group#getAllRoles()
+   * @see #getGroup()
+   * @generated
+   */
+  EReference getGroup_AllRoles();
+
+  /**
    * Returns the meta object for class '{@link org.eclipse.emf.cdo.security.User <em>User</em>}'.
    * <!-- begin-user-doc -->
    * <!-- end-user-doc -->
@@ -740,6 +827,39 @@ public interface SecurityPackage extends EPackage
   EReference getUser_Groups();
 
   /**
+   * Returns the meta object for the reference list '{@link org.eclipse.emf.cdo.security.User#getAllGroups <em>All Groups</em>}'.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @return the meta object for the reference list '<em>All Groups</em>'.
+   * @see org.eclipse.emf.cdo.security.User#getAllGroups()
+   * @see #getUser()
+   * @generated
+   */
+  EReference getUser_AllGroups();
+
+  /**
+   * Returns the meta object for the reference list '{@link org.eclipse.emf.cdo.security.User#getAllRoles <em>All Roles</em>}'.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @return the meta object for the reference list '<em>All Roles</em>'.
+   * @see org.eclipse.emf.cdo.security.User#getAllRoles()
+   * @see #getUser()
+   * @generated
+   */
+  EReference getUser_AllRoles();
+
+  /**
+   * Returns the meta object for the attribute '{@link org.eclipse.emf.cdo.security.User#getLabel <em>Label</em>}'.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @return the meta object for the attribute '<em>Label</em>'.
+   * @see org.eclipse.emf.cdo.security.User#getLabel()
+   * @see #getUser()
+   * @generated
+   */
+  EAttribute getUser_Label();
+
+  /**
    * Returns the meta object for the attribute '{@link org.eclipse.emf.cdo.security.User#getFirstName <em>First Name</em>}'.
    * <!-- begin-user-doc -->
    * <!-- end-user-doc -->
@@ -1005,6 +1125,30 @@ public interface SecurityPackage extends EPackage
     EReference GROUP__INHERITING_GROUPS = eINSTANCE.getGroup_InheritingGroups();
 
     /**
+     * The meta object literal for the '<em><b>All Inheriting Groups</b></em>' reference list feature.
+     * <!-- begin-user-doc -->
+     * <!-- end-user-doc -->
+     * @generated
+     */
+    EReference GROUP__ALL_INHERITING_GROUPS = eINSTANCE.getGroup_AllInheritingGroups();
+
+    /**
+     * The meta object literal for the '<em><b>All Inherited Groups</b></em>' reference list feature.
+     * <!-- begin-user-doc -->
+     * <!-- end-user-doc -->
+     * @generated
+     */
+    EReference GROUP__ALL_INHERITED_GROUPS = eINSTANCE.getGroup_AllInheritedGroups();
+
+    /**
+     * The meta object literal for the '<em><b>All Roles</b></em>' reference list feature.
+     * <!-- begin-user-doc -->
+     * <!-- end-user-doc -->
+     * @generated
+     */
+    EReference GROUP__ALL_ROLES = eINSTANCE.getGroup_AllRoles();
+
+    /**
      * The meta object literal for the '{@link org.eclipse.emf.cdo.security.impl.UserImpl <em>User</em>}' class.
      * <!-- begin-user-doc -->
      * <!-- end-user-doc -->
@@ -1023,6 +1167,30 @@ public interface SecurityPackage extends EPackage
     EReference USER__GROUPS = eINSTANCE.getUser_Groups();
 
     /**
+     * The meta object literal for the '<em><b>All Groups</b></em>' reference list feature.
+     * <!-- begin-user-doc -->
+     * <!-- end-user-doc -->
+     * @generated
+     */
+    EReference USER__ALL_GROUPS = eINSTANCE.getUser_AllGroups();
+
+    /**
+     * The meta object literal for the '<em><b>All Roles</b></em>' reference list feature.
+     * <!-- begin-user-doc -->
+     * <!-- end-user-doc -->
+     * @generated
+     */
+    EReference USER__ALL_ROLES = eINSTANCE.getUser_AllRoles();
+
+    /**
+     * The meta object literal for the '<em><b>Label</b></em>' attribute feature.
+     * <!-- begin-user-doc -->
+     * <!-- end-user-doc -->
+     * @generated
+     */
+    EAttribute USER__LABEL = eINSTANCE.getUser_Label();
+
+    /**
      * The meta object literal for the '<em><b>First Name</b></em>' attribute feature.
      * <!-- begin-user-doc -->
      * <!-- end-user-doc -->
diff --git a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/User.java b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/User.java
index 5090f476d6..08e9a95182 100644
--- a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/User.java
+++ b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/User.java
@@ -21,6 +21,9 @@ import org.eclipse.emf.common.util.EList;
  * The following features are supported:
  * <ul>
  *   <li>{@link org.eclipse.emf.cdo.security.User#getGroups <em>Groups</em>}</li>
+ *   <li>{@link org.eclipse.emf.cdo.security.User#getAllGroups <em>All Groups</em>}</li>
+ *   <li>{@link org.eclipse.emf.cdo.security.User#getAllRoles <em>All Roles</em>}</li>
+ *   <li>{@link org.eclipse.emf.cdo.security.User#getLabel <em>Label</em>}</li>
  *   <li>{@link org.eclipse.emf.cdo.security.User#getFirstName <em>First Name</em>}</li>
  *   <li>{@link org.eclipse.emf.cdo.security.User#getLastName <em>Last Name</em>}</li>
  *   <li>{@link org.eclipse.emf.cdo.security.User#getEmail <em>Email</em>}</li>
@@ -54,6 +57,53 @@ public interface User extends Assignee
   EList<Group> getGroups();
 
   /**
+   * Returns the value of the '<em><b>All Groups</b></em>' reference list.
+   * The list contents are of type {@link org.eclipse.emf.cdo.security.Group}.
+   * <!-- begin-user-doc -->
+   * <p>
+   * If the meaning of the '<em>All Groups</em>' reference list isn't clear,
+   * there really should be more of a description here...
+   * </p>
+   * <!-- end-user-doc -->
+   * @return the value of the '<em>All Groups</em>' reference list.
+   * @see org.eclipse.emf.cdo.security.SecurityPackage#getUser_AllGroups()
+   * @model transient="true" changeable="false" volatile="true" derived="true"
+   * @generated
+   */
+  EList<Group> getAllGroups();
+
+  /**
+   * Returns the value of the '<em><b>All Roles</b></em>' reference list.
+   * The list contents are of type {@link org.eclipse.emf.cdo.security.Role}.
+   * <!-- begin-user-doc -->
+   * <p>
+   * If the meaning of the '<em>All Roles</em>' reference list isn't clear,
+   * there really should be more of a description here...
+   * </p>
+   * <!-- end-user-doc -->
+   * @return the value of the '<em>All Roles</em>' reference list.
+   * @see org.eclipse.emf.cdo.security.SecurityPackage#getUser_AllRoles()
+   * @model transient="true" changeable="false" volatile="true" derived="true"
+   * @generated
+   */
+  EList<Role> getAllRoles();
+
+  /**
+   * Returns the value of the '<em><b>Label</b></em>' attribute.
+   * <!-- begin-user-doc -->
+   * <p>
+   * If the meaning of the '<em>Label</em>' attribute isn't clear,
+   * there really should be more of a description here...
+   * </p>
+   * <!-- end-user-doc -->
+   * @return the value of the '<em>Label</em>' attribute.
+   * @see org.eclipse.emf.cdo.security.SecurityPackage#getUser_Label()
+   * @model transient="true" changeable="false" volatile="true" derived="true"
+   * @generated
+   */
+  String getLabel();
+
+  /**
    * Returns the value of the '<em><b>First Name</b></em>' attribute.
    * <!-- begin-user-doc -->
    * <p>
diff --git a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/CachedList.java b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/CachedList.java
new file mode 100644
index 0000000000..8d52f21f45
--- /dev/null
+++ b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/CachedList.java
@@ -0,0 +1,345 @@
+/*
+ * Copyright (c) 2004 - 2012 Eike Stepper (Berlin, Germany) and others.
+ * All rights reserved. This program and the accompanying materials
+ * are made available under the terms of the Eclipse Public License v1.0
+ * which accompanies this distribution, and is available at
+ * http://www.eclipse.org/legal/epl-v10.html
+ *
+ * Contributors:
+ *    Eike Stepper - initial API and implementation
+ */
+package org.eclipse.emf.cdo.security.impl;
+
+import org.eclipse.emf.common.notify.NotificationChain;
+import org.eclipse.emf.ecore.EObject;
+import org.eclipse.emf.ecore.EStructuralFeature;
+import org.eclipse.emf.ecore.InternalEObject;
+import org.eclipse.emf.ecore.util.EcoreEList;
+import org.eclipse.emf.ecore.util.InternalEList;
+
+import java.lang.ref.SoftReference;
+import java.util.Collection;
+import java.util.HashSet;
+import java.util.Iterator;
+import java.util.List;
+import java.util.ListIterator;
+import java.util.Set;
+
+/**
+ * @author Eike Stepper
+ */
+abstract class CachedList<E extends EObject> implements InternalEList<E>, EStructuralFeature.Setting
+{
+  private SoftReference<Object[]> cache;
+
+  protected CachedList()
+  {
+  }
+
+  private InternalEList<E> getList()
+  {
+    Object[] data = null;
+    if (cache != null)
+    {
+      data = cache.get();
+    }
+
+    if (data == null)
+    {
+      data = getData();
+      cache = new SoftReference<Object[]>(data);
+    }
+
+    InternalEObject owner = getOwner();
+    EStructuralFeature feature = getFeature();
+    return new EcoreEList.UnmodifiableEList.FastCompare<E>(owner, feature, data.length, data);
+  }
+
+  protected abstract InternalEObject getOwner();
+
+  protected abstract EStructuralFeature getFeature();
+
+  protected abstract Object[] getData();
+
+  public void move(int newPosition, E object)
+  {
+    getList().move(newPosition, object);
+  }
+
+  public E move(int newPosition, int oldPosition)
+  {
+    return getList().move(newPosition, oldPosition);
+  }
+
+  public E basicGet(int index)
+  {
+    return getList().basicGet(index);
+  }
+
+  public List<E> basicList()
+  {
+    return getList().basicList();
+  }
+
+  public Iterator<E> basicIterator()
+  {
+    return getList().basicIterator();
+  }
+
+  public ListIterator<E> basicListIterator()
+  {
+    return getList().basicListIterator();
+  }
+
+  public ListIterator<E> basicListIterator(int index)
+  {
+    return getList().basicListIterator(index);
+  }
+
+  public Object[] basicToArray()
+  {
+    return getList().basicToArray();
+  }
+
+  public <T> T[] basicToArray(T[] array)
+  {
+    return getList().basicToArray(array);
+  }
+
+  public int basicIndexOf(Object object)
+  {
+    return getList().basicIndexOf(object);
+  }
+
+  public int basicLastIndexOf(Object object)
+  {
+    return getList().basicLastIndexOf(object);
+  }
+
+  public boolean basicContains(Object object)
+  {
+    return getList().basicContains(object);
+  }
+
+  public boolean basicContainsAll(Collection<?> collection)
+  {
+    return getList().basicContainsAll(collection);
+  }
+
+  public NotificationChain basicRemove(Object object, NotificationChain notifications)
+  {
+    return getList().basicRemove(object, notifications);
+  }
+
+  public NotificationChain basicAdd(E object, NotificationChain notifications)
+  {
+    return getList().basicAdd(object, notifications);
+  }
+
+  public void addUnique(E object)
+  {
+    getList().addUnique(object);
+  }
+
+  public void addUnique(int index, E object)
+  {
+    getList().addUnique(index, object);
+  }
+
+  public boolean addAllUnique(Collection<? extends E> collection)
+  {
+    return getList().addAllUnique(collection);
+  }
+
+  public boolean addAllUnique(int index, Collection<? extends E> collection)
+  {
+    return getList().addAllUnique(index, collection);
+  }
+
+  public E setUnique(int index, E object)
+  {
+    return getList().setUnique(index, object);
+  }
+
+  public int size()
+  {
+    return getList().size();
+  }
+
+  public boolean isEmpty()
+  {
+    return getList().isEmpty();
+  }
+
+  public boolean contains(Object o)
+  {
+    return getList().contains(o);
+  }
+
+  public Iterator<E> iterator()
+  {
+    return getList().iterator();
+  }
+
+  public Object[] toArray()
+  {
+    return getList().toArray();
+  }
+
+  public <T> T[] toArray(T[] a)
+  {
+    return getList().toArray(a);
+  }
+
+  public boolean add(E e)
+  {
+    return getList().add(e);
+  }
+
+  public boolean remove(Object o)
+  {
+    return getList().remove(o);
+  }
+
+  public boolean containsAll(Collection<?> c)
+  {
+    return getList().containsAll(c);
+  }
+
+  public boolean addAll(Collection<? extends E> c)
+  {
+    return getList().addAll(c);
+  }
+
+  public boolean addAll(int index, Collection<? extends E> c)
+  {
+    return getList().addAll(index, c);
+  }
+
+  public boolean removeAll(Collection<?> c)
+  {
+    return getList().removeAll(c);
+  }
+
+  public boolean retainAll(Collection<?> c)
+  {
+    return getList().retainAll(c);
+  }
+
+  public void clear()
+  {
+    getList().clear();
+  }
+
+  @Override
+  public boolean equals(Object o)
+  {
+    return getList().equals(o);
+  }
+
+  @Override
+  public int hashCode()
+  {
+    return getList().hashCode();
+  }
+
+  public E get(int index)
+  {
+    return getList().get(index);
+  }
+
+  public E set(int index, E element)
+  {
+    return getList().set(index, element);
+  }
+
+  public void add(int index, E element)
+  {
+    getList().add(index, element);
+  }
+
+  public E remove(int index)
+  {
+    return getList().remove(index);
+  }
+
+  public int indexOf(Object o)
+  {
+    return getList().indexOf(o);
+  }
+
+  public int lastIndexOf(Object o)
+  {
+    return getList().lastIndexOf(o);
+  }
+
+  public ListIterator<E> listIterator()
+  {
+    return getList().listIterator();
+  }
+
+  public ListIterator<E> listIterator(int index)
+  {
+    return getList().listIterator(index);
+  }
+
+  public List<E> subList(int fromIndex, int toIndex)
+  {
+    return getList().subList(fromIndex, toIndex);
+  }
+
+  public EObject getEObject()
+  {
+    return getOwner();
+  }
+
+  public EStructuralFeature getEStructuralFeature()
+  {
+    return getFeature();
+  }
+
+  public Object get(boolean resolve)
+  {
+    return getList();
+  }
+
+  public void set(Object newValue)
+  {
+    throw new UnsupportedOperationException();
+  }
+
+  public boolean isSet()
+  {
+    return !getList().isEmpty();
+  }
+
+  public void unset()
+  {
+    throw new UnsupportedOperationException();
+  }
+
+  /**
+   * @author Eike Stepper
+   */
+  static abstract class RecursionSafe<E extends EObject, O extends EObject> extends CachedList<E>
+  {
+    protected RecursionSafe()
+    {
+    }
+
+    @Override
+    protected Object[] getData()
+    {
+      @SuppressWarnings("unchecked")
+      O start = (O)getOwner();
+
+      Set<Object> visited = new HashSet<Object>();
+      Set<E> result = new HashSet<E>();
+
+      getData(start, visited, result);
+      return result.toArray();
+    }
+
+    protected abstract void getData(O object, Set<Object> visited, Set<E> result);
+  }
+}
diff --git a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/GroupImpl.java b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/GroupImpl.java
index ca4a5b30ca..76c9259a40 100644
--- a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/GroupImpl.java
+++ b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/GroupImpl.java
@@ -11,11 +11,16 @@
 package org.eclipse.emf.cdo.security.impl;
 
 import org.eclipse.emf.cdo.security.Group;
+import org.eclipse.emf.cdo.security.Role;
 import org.eclipse.emf.cdo.security.SecurityPackage;
 import org.eclipse.emf.cdo.security.User;
 
 import org.eclipse.emf.common.util.EList;
 import org.eclipse.emf.ecore.EClass;
+import org.eclipse.emf.ecore.EStructuralFeature;
+import org.eclipse.emf.ecore.InternalEObject;
+
+import java.util.Set;
 
 /**
  * <!-- begin-user-doc -->
@@ -25,7 +30,10 @@ import org.eclipse.emf.ecore.EClass;
  * The following features are implemented:
  * <ul>
  *   <li>{@link org.eclipse.emf.cdo.security.impl.GroupImpl#getInheritedGroups <em>Inherited Groups</em>}</li>
+ *   <li>{@link org.eclipse.emf.cdo.security.impl.GroupImpl#getAllInheritedGroups <em>All Inherited Groups</em>}</li>
  *   <li>{@link org.eclipse.emf.cdo.security.impl.GroupImpl#getInheritingGroups <em>Inheriting Groups</em>}</li>
+ *   <li>{@link org.eclipse.emf.cdo.security.impl.GroupImpl#getAllInheritingGroups <em>All Inheriting Groups</em>}</li>
+ *   <li>{@link org.eclipse.emf.cdo.security.impl.GroupImpl#getAllRoles <em>All Roles</em>}</li>
  *   <li>{@link org.eclipse.emf.cdo.security.impl.GroupImpl#getUsers <em>Users</em>}</li>
  * </ul>
  * </p>
@@ -34,6 +42,94 @@ import org.eclipse.emf.ecore.EClass;
  */
 public class GroupImpl extends AssigneeImpl implements Group
 {
+  private EList<Group> allInheritedGroups = new CachedList.RecursionSafe<Group, Group>()
+  {
+    @Override
+    protected InternalEObject getOwner()
+    {
+      return GroupImpl.this;
+    }
+
+    @Override
+    protected EStructuralFeature getFeature()
+    {
+      return SecurityPackage.Literals.GROUP__ALL_INHERITED_GROUPS;
+    }
+
+    @Override
+    protected void getData(Group group, Set<Object> visited, Set<Group> result)
+    {
+      if (visited.add(group))
+      {
+        result.add(group);
+
+        for (Group inheritedGroup : group.getInheritedGroups())
+        {
+          getData(inheritedGroup, visited, result);
+        }
+      }
+    }
+  };
+
+  private EList<Group> allInheritingGroups = new CachedList.RecursionSafe<Group, Group>()
+  {
+    @Override
+    protected InternalEObject getOwner()
+    {
+      return GroupImpl.this;
+    }
+
+    @Override
+    protected EStructuralFeature getFeature()
+    {
+      return SecurityPackage.Literals.GROUP__ALL_INHERITING_GROUPS;
+    }
+
+    @Override
+    protected void getData(Group group, Set<Object> visited, Set<Group> result)
+    {
+      if (visited.add(group))
+      {
+        result.add(group);
+
+        for (Group inheritingGroup : group.getInheritingGroups())
+        {
+          getData(inheritingGroup, visited, result);
+        }
+      }
+    }
+  };
+
+  private EList<Role> allRoles = new CachedList.RecursionSafe<Role, Group>()
+  {
+    @Override
+    protected InternalEObject getOwner()
+    {
+      return GroupImpl.this;
+    }
+
+    @Override
+    protected EStructuralFeature getFeature()
+    {
+      return SecurityPackage.Literals.GROUP__ALL_ROLES;
+    }
+
+    @Override
+    protected void getData(Group group, Set<Object> visited, Set<Role> result)
+    {
+      if (visited.add(group))
+      {
+        EList<Role> roles = group.getRoles();
+        result.addAll(roles);
+
+        for (Group inheritedGroup : group.getInheritedGroups())
+        {
+          getData(inheritedGroup, visited, result);
+        }
+      }
+    }
+  };
+
   /**
    * <!-- begin-user-doc -->
    * <!-- end-user-doc -->
@@ -88,4 +184,34 @@ public class GroupImpl extends AssigneeImpl implements Group
     return (EList<Group>)eGet(SecurityPackage.Literals.GROUP__INHERITING_GROUPS, true);
   }
 
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated NOT
+   */
+  public EList<Group> getAllInheritingGroups()
+  {
+    return allInheritingGroups;
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated NOT
+   */
+  public EList<Group> getAllInheritedGroups()
+  {
+    return allInheritedGroups;
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated NOT
+   */
+  public EList<Role> getAllRoles()
+  {
+    return allRoles;
+  }
+
 } // GroupImpl
diff --git a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/SecurityFactoryImpl.java b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/SecurityFactoryImpl.java
index 3b0f840b83..e2eb2a9ad2 100644
--- a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/SecurityFactoryImpl.java
+++ b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/SecurityFactoryImpl.java
@@ -10,6 +10,7 @@
  */
 package org.eclipse.emf.cdo.security.impl;
 
+//import org.eclipse.emf.cdo.security.*;
 import org.eclipse.emf.cdo.security.Directory;
 import org.eclipse.emf.cdo.security.Group;
 import org.eclipse.emf.cdo.security.Realm;
@@ -44,7 +45,7 @@ public class SecurityFactoryImpl extends EFactoryImpl implements SecurityFactory
     try
     {
       SecurityFactory theSecurityFactory = (SecurityFactory)EPackage.Registry.INSTANCE
-          .getEFactory("http://www.eclipse.org/emf/CDO/security/4.1.0"); //$NON-NLS-1$
+          .getEFactory("http://www.eclipse.org/emf/CDO/security/4.1.0"); //$NON-NLS-1$ 
       if (theSecurityFactory != null)
       {
         return theSecurityFactory;
@@ -79,17 +80,17 @@ public class SecurityFactoryImpl extends EFactoryImpl implements SecurityFactory
     switch (eClass.getClassifierID())
     {
     case SecurityPackage.REALM:
-      return createRealm();
+      return (EObject)createRealm();
     case SecurityPackage.DIRECTORY:
-      return createDirectory();
+      return (EObject)createDirectory();
     case SecurityPackage.ROLE:
-      return createRole();
+      return (EObject)createRole();
     case SecurityPackage.GROUP:
-      return createGroup();
+      return (EObject)createGroup();
     case SecurityPackage.USER:
-      return createUser();
+      return (EObject)createUser();
     case SecurityPackage.USER_PASSWORD:
-      return createUserPassword();
+      return (EObject)createUserPassword();
     default:
       throw new IllegalArgumentException("The class '" + eClass.getName() + "' is not a valid classifier"); //$NON-NLS-1$ //$NON-NLS-2$
     }
diff --git a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/SecurityPackageImpl.java b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/SecurityPackageImpl.java
index f6c2e83ec0..e230d2da94 100644
--- a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/SecurityPackageImpl.java
+++ b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/SecurityPackageImpl.java
@@ -130,7 +130,7 @@ public class SecurityPackageImpl extends EPackageImpl implements SecurityPackage
 
   /**
    * Creates, registers, and initializes the <b>Package</b> for this model, and for any others upon which it depends.
-   *
+   * 
    * <p>This method is used to initialize {@link SecurityPackage#eINSTANCE} when that field is accessed.
    * Clients should not invoke it directly. Instead, they should simply access that field to obtain the package.
    * <!-- begin-user-doc -->
@@ -143,9 +143,7 @@ public class SecurityPackageImpl extends EPackageImpl implements SecurityPackage
   public static SecurityPackage init()
   {
     if (isInited)
-    {
       return (SecurityPackage)EPackage.Registry.INSTANCE.getEPackage(SecurityPackage.eNS_URI);
-    }
 
     // Obtain or create and register package
     SecurityPackageImpl theSecurityPackage = (SecurityPackageImpl)(EPackage.Registry.INSTANCE.get(eNS_URI) instanceof SecurityPackageImpl ? EPackage.Registry.INSTANCE
@@ -337,7 +335,7 @@ public class SecurityPackageImpl extends EPackageImpl implements SecurityPackage
    */
   public EReference getGroup_Users()
   {
-    return (EReference)groupEClass.getEStructuralFeatures().get(2);
+    return (EReference)groupEClass.getEStructuralFeatures().get(5);
   }
 
   /**
@@ -357,6 +355,26 @@ public class SecurityPackageImpl extends EPackageImpl implements SecurityPackage
    */
   public EReference getGroup_InheritingGroups()
   {
+    return (EReference)groupEClass.getEStructuralFeatures().get(2);
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public EReference getGroup_AllInheritingGroups()
+  {
+    return (EReference)groupEClass.getEStructuralFeatures().get(3);
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public EReference getGroup_AllInheritedGroups()
+  {
     return (EReference)groupEClass.getEStructuralFeatures().get(1);
   }
 
@@ -365,6 +383,16 @@ public class SecurityPackageImpl extends EPackageImpl implements SecurityPackage
    * <!-- end-user-doc -->
    * @generated
    */
+  public EReference getGroup_AllRoles()
+  {
+    return (EReference)groupEClass.getEStructuralFeatures().get(4);
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
   public EClass getUser()
   {
     return userEClass;
@@ -385,9 +413,39 @@ public class SecurityPackageImpl extends EPackageImpl implements SecurityPackage
    * <!-- end-user-doc -->
    * @generated
    */
+  public EReference getUser_AllGroups()
+  {
+    return (EReference)userEClass.getEStructuralFeatures().get(1);
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public EReference getUser_AllRoles()
+  {
+    return (EReference)userEClass.getEStructuralFeatures().get(2);
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public EAttribute getUser_Label()
+  {
+    return (EAttribute)userEClass.getEStructuralFeatures().get(3);
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
   public EAttribute getUser_FirstName()
   {
-    return (EAttribute)userEClass.getEStructuralFeatures().get(1);
+    return (EAttribute)userEClass.getEStructuralFeatures().get(4);
   }
 
   /**
@@ -397,7 +455,7 @@ public class SecurityPackageImpl extends EPackageImpl implements SecurityPackage
    */
   public EAttribute getUser_LastName()
   {
-    return (EAttribute)userEClass.getEStructuralFeatures().get(2);
+    return (EAttribute)userEClass.getEStructuralFeatures().get(5);
   }
 
   /**
@@ -407,7 +465,7 @@ public class SecurityPackageImpl extends EPackageImpl implements SecurityPackage
    */
   public EAttribute getUser_Email()
   {
-    return (EAttribute)userEClass.getEStructuralFeatures().get(3);
+    return (EAttribute)userEClass.getEStructuralFeatures().get(6);
   }
 
   /**
@@ -417,7 +475,7 @@ public class SecurityPackageImpl extends EPackageImpl implements SecurityPackage
    */
   public EAttribute getUser_Locked()
   {
-    return (EAttribute)userEClass.getEStructuralFeatures().get(4);
+    return (EAttribute)userEClass.getEStructuralFeatures().get(7);
   }
 
   /**
@@ -427,7 +485,7 @@ public class SecurityPackageImpl extends EPackageImpl implements SecurityPackage
    */
   public EReference getUser_Password()
   {
-    return (EReference)userEClass.getEStructuralFeatures().get(5);
+    return (EReference)userEClass.getEStructuralFeatures().get(8);
   }
 
   /**
@@ -477,9 +535,7 @@ public class SecurityPackageImpl extends EPackageImpl implements SecurityPackage
   public void createPackageContents()
   {
     if (isCreated)
-    {
       return;
-    }
     isCreated = true;
 
     // Create classes and their features
@@ -506,11 +562,17 @@ public class SecurityPackageImpl extends EPackageImpl implements SecurityPackage
 
     groupEClass = createEClass(GROUP);
     createEReference(groupEClass, GROUP__INHERITED_GROUPS);
+    createEReference(groupEClass, GROUP__ALL_INHERITED_GROUPS);
     createEReference(groupEClass, GROUP__INHERITING_GROUPS);
+    createEReference(groupEClass, GROUP__ALL_INHERITING_GROUPS);
+    createEReference(groupEClass, GROUP__ALL_ROLES);
     createEReference(groupEClass, GROUP__USERS);
 
     userEClass = createEClass(USER);
     createEReference(userEClass, USER__GROUPS);
+    createEReference(userEClass, USER__ALL_GROUPS);
+    createEReference(userEClass, USER__ALL_ROLES);
+    createEAttribute(userEClass, USER__LABEL);
     createEAttribute(userEClass, USER__FIRST_NAME);
     createEAttribute(userEClass, USER__LAST_NAME);
     createEAttribute(userEClass, USER__EMAIL);
@@ -538,9 +600,7 @@ public class SecurityPackageImpl extends EPackageImpl implements SecurityPackage
   public void initializePackageContents()
   {
     if (isInitialized)
-    {
       return;
-    }
     isInitialized = true;
 
     // Initialize package
@@ -558,19 +618,19 @@ public class SecurityPackageImpl extends EPackageImpl implements SecurityPackage
 
     // Add supertypes to classes
     securityElementEClass.getESuperTypes().add(theEtypesPackage.getModelElement());
-    securityItemEClass.getESuperTypes().add(getSecurityElement());
-    realmEClass.getESuperTypes().add(getSecurityElement());
-    directoryEClass.getESuperTypes().add(getSecurityItem());
-    roleEClass.getESuperTypes().add(getSecurityItem());
-    assigneeEClass.getESuperTypes().add(getSecurityItem());
-    groupEClass.getESuperTypes().add(getAssignee());
-    userEClass.getESuperTypes().add(getAssignee());
+    securityItemEClass.getESuperTypes().add(this.getSecurityElement());
+    realmEClass.getESuperTypes().add(this.getSecurityElement());
+    directoryEClass.getESuperTypes().add(this.getSecurityItem());
+    roleEClass.getESuperTypes().add(this.getSecurityItem());
+    assigneeEClass.getESuperTypes().add(this.getSecurityItem());
+    groupEClass.getESuperTypes().add(this.getAssignee());
+    userEClass.getESuperTypes().add(this.getAssignee());
 
     // Initialize classes and features; add operations and parameters
     initEClass(securityElementEClass, SecurityElement.class,
         "SecurityElement", IS_ABSTRACT, !IS_INTERFACE, IS_GENERATED_INSTANCE_CLASS); //$NON-NLS-1$
 
-    addEOperation(securityElementEClass, getRealm(), "getRealm", 1, 1, IS_UNIQUE, IS_ORDERED); //$NON-NLS-1$
+    addEOperation(securityElementEClass, this.getRealm(), "getRealm", 1, 1, IS_UNIQUE, IS_ORDERED); //$NON-NLS-1$
 
     initEClass(securityItemEClass, SecurityItem.class,
         "SecurityItem", IS_ABSTRACT, !IS_INTERFACE, IS_GENERATED_INSTANCE_CLASS); //$NON-NLS-1$
@@ -578,7 +638,7 @@ public class SecurityPackageImpl extends EPackageImpl implements SecurityPackage
     initEClass(realmEClass, Realm.class, "Realm", !IS_ABSTRACT, !IS_INTERFACE, IS_GENERATED_INSTANCE_CLASS); //$NON-NLS-1$
     initEReference(
         getRealm_Items(),
-        getSecurityItem(),
+        this.getSecurityItem(),
         null,
         "items", null, 0, -1, Realm.class, !IS_TRANSIENT, !IS_VOLATILE, IS_CHANGEABLE, IS_COMPOSITE, !IS_RESOLVE_PROXIES, !IS_UNSETTABLE, IS_UNIQUE, !IS_DERIVED, IS_ORDERED); //$NON-NLS-1$
     initEAttribute(
@@ -589,7 +649,7 @@ public class SecurityPackageImpl extends EPackageImpl implements SecurityPackage
     initEClass(directoryEClass, Directory.class, "Directory", !IS_ABSTRACT, !IS_INTERFACE, IS_GENERATED_INSTANCE_CLASS); //$NON-NLS-1$
     initEReference(
         getDirectory_Items(),
-        getSecurityItem(),
+        this.getSecurityItem(),
         null,
         "items", null, 0, -1, Directory.class, !IS_TRANSIENT, !IS_VOLATILE, IS_CHANGEABLE, IS_COMPOSITE, !IS_RESOLVE_PROXIES, !IS_UNSETTABLE, IS_UNIQUE, !IS_DERIVED, IS_ORDERED); //$NON-NLS-1$
     initEAttribute(
@@ -600,8 +660,8 @@ public class SecurityPackageImpl extends EPackageImpl implements SecurityPackage
     initEClass(roleEClass, Role.class, "Role", !IS_ABSTRACT, !IS_INTERFACE, IS_GENERATED_INSTANCE_CLASS); //$NON-NLS-1$
     initEReference(
         getRole_Assignees(),
-        getAssignee(),
-        getAssignee_Roles(),
+        this.getAssignee(),
+        this.getAssignee_Roles(),
         "assignees", null, 0, -1, Role.class, !IS_TRANSIENT, !IS_VOLATILE, IS_CHANGEABLE, !IS_COMPOSITE, IS_RESOLVE_PROXIES, !IS_UNSETTABLE, IS_UNIQUE, !IS_DERIVED, IS_ORDERED); //$NON-NLS-1$
     initEAttribute(
         getRole_Id(),
@@ -615,8 +675,8 @@ public class SecurityPackageImpl extends EPackageImpl implements SecurityPackage
     initEClass(assigneeEClass, Assignee.class, "Assignee", IS_ABSTRACT, !IS_INTERFACE, IS_GENERATED_INSTANCE_CLASS); //$NON-NLS-1$
     initEReference(
         getAssignee_Roles(),
-        getRole(),
-        getRole_Assignees(),
+        this.getRole(),
+        this.getRole_Assignees(),
         "roles", null, 0, -1, Assignee.class, !IS_TRANSIENT, !IS_VOLATILE, IS_CHANGEABLE, !IS_COMPOSITE, IS_RESOLVE_PROXIES, !IS_UNSETTABLE, IS_UNIQUE, !IS_DERIVED, IS_ORDERED); //$NON-NLS-1$
     initEAttribute(
         getAssignee_Id(),
@@ -626,26 +686,55 @@ public class SecurityPackageImpl extends EPackageImpl implements SecurityPackage
     initEClass(groupEClass, Group.class, "Group", !IS_ABSTRACT, !IS_INTERFACE, IS_GENERATED_INSTANCE_CLASS); //$NON-NLS-1$
     initEReference(
         getGroup_InheritedGroups(),
-        getGroup(),
-        getGroup_InheritingGroups(),
+        this.getGroup(),
+        this.getGroup_InheritingGroups(),
         "inheritedGroups", null, 0, -1, Group.class, !IS_TRANSIENT, !IS_VOLATILE, IS_CHANGEABLE, !IS_COMPOSITE, IS_RESOLVE_PROXIES, !IS_UNSETTABLE, IS_UNIQUE, !IS_DERIVED, IS_ORDERED); //$NON-NLS-1$
     initEReference(
+        getGroup_AllInheritedGroups(),
+        this.getGroup(),
+        null,
+        "allInheritedGroups", null, 0, -1, Group.class, IS_TRANSIENT, IS_VOLATILE, !IS_CHANGEABLE, !IS_COMPOSITE, IS_RESOLVE_PROXIES, !IS_UNSETTABLE, IS_UNIQUE, IS_DERIVED, IS_ORDERED); //$NON-NLS-1$
+    initEReference(
         getGroup_InheritingGroups(),
-        getGroup(),
-        getGroup_InheritedGroups(),
+        this.getGroup(),
+        this.getGroup_InheritedGroups(),
         "inheritingGroups", null, 0, -1, Group.class, !IS_TRANSIENT, !IS_VOLATILE, IS_CHANGEABLE, !IS_COMPOSITE, IS_RESOLVE_PROXIES, !IS_UNSETTABLE, IS_UNIQUE, !IS_DERIVED, IS_ORDERED); //$NON-NLS-1$
     initEReference(
+        getGroup_AllInheritingGroups(),
+        this.getGroup(),
+        null,
+        "allInheritingGroups", null, 0, -1, Group.class, IS_TRANSIENT, IS_VOLATILE, !IS_CHANGEABLE, !IS_COMPOSITE, IS_RESOLVE_PROXIES, !IS_UNSETTABLE, IS_UNIQUE, IS_DERIVED, IS_ORDERED); //$NON-NLS-1$
+    initEReference(
+        getGroup_AllRoles(),
+        this.getRole(),
+        null,
+        "allRoles", null, 0, -1, Group.class, IS_TRANSIENT, IS_VOLATILE, !IS_CHANGEABLE, !IS_COMPOSITE, IS_RESOLVE_PROXIES, !IS_UNSETTABLE, IS_UNIQUE, IS_DERIVED, IS_ORDERED); //$NON-NLS-1$
+    initEReference(
         getGroup_Users(),
-        getUser(),
-        getUser_Groups(),
+        this.getUser(),
+        this.getUser_Groups(),
         "users", null, 0, -1, Group.class, !IS_TRANSIENT, !IS_VOLATILE, IS_CHANGEABLE, !IS_COMPOSITE, IS_RESOLVE_PROXIES, !IS_UNSETTABLE, IS_UNIQUE, !IS_DERIVED, IS_ORDERED); //$NON-NLS-1$
 
     initEClass(userEClass, User.class, "User", !IS_ABSTRACT, !IS_INTERFACE, IS_GENERATED_INSTANCE_CLASS); //$NON-NLS-1$
     initEReference(
         getUser_Groups(),
-        getGroup(),
-        getGroup_Users(),
+        this.getGroup(),
+        this.getGroup_Users(),
         "groups", null, 0, -1, User.class, !IS_TRANSIENT, !IS_VOLATILE, IS_CHANGEABLE, !IS_COMPOSITE, IS_RESOLVE_PROXIES, !IS_UNSETTABLE, IS_UNIQUE, !IS_DERIVED, IS_ORDERED); //$NON-NLS-1$
+    initEReference(
+        getUser_AllGroups(),
+        this.getGroup(),
+        null,
+        "allGroups", null, 0, -1, User.class, IS_TRANSIENT, IS_VOLATILE, !IS_CHANGEABLE, !IS_COMPOSITE, IS_RESOLVE_PROXIES, !IS_UNSETTABLE, IS_UNIQUE, IS_DERIVED, IS_ORDERED); //$NON-NLS-1$
+    initEReference(
+        getUser_AllRoles(),
+        this.getRole(),
+        null,
+        "allRoles", null, 0, -1, User.class, IS_TRANSIENT, IS_VOLATILE, !IS_CHANGEABLE, !IS_COMPOSITE, IS_RESOLVE_PROXIES, !IS_UNSETTABLE, IS_UNIQUE, IS_DERIVED, IS_ORDERED); //$NON-NLS-1$
+    initEAttribute(
+        getUser_Label(),
+        theEcorePackage.getEString(),
+        "label", null, 0, 1, User.class, IS_TRANSIENT, IS_VOLATILE, !IS_CHANGEABLE, !IS_UNSETTABLE, !IS_ID, IS_UNIQUE, IS_DERIVED, IS_ORDERED); //$NON-NLS-1$
     initEAttribute(
         getUser_FirstName(),
         theEcorePackage.getEString(),
@@ -664,7 +753,7 @@ public class SecurityPackageImpl extends EPackageImpl implements SecurityPackage
         "locked", null, 0, 1, User.class, !IS_TRANSIENT, !IS_VOLATILE, IS_CHANGEABLE, !IS_UNSETTABLE, !IS_ID, IS_UNIQUE, !IS_DERIVED, IS_ORDERED); //$NON-NLS-1$
     initEReference(
         getUser_Password(),
-        getUserPassword(),
+        this.getUserPassword(),
         null,
         "password", null, 0, 1, User.class, !IS_TRANSIENT, !IS_VOLATILE, IS_CHANGEABLE, IS_COMPOSITE, !IS_RESOLVE_PROXIES, !IS_UNSETTABLE, IS_UNIQUE, !IS_DERIVED, IS_ORDERED); //$NON-NLS-1$
 
diff --git a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/UserImpl.java b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/UserImpl.java
index bca8da5863..b89ea6527d 100644
--- a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/UserImpl.java
+++ b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/UserImpl.java
@@ -11,12 +11,18 @@
 package org.eclipse.emf.cdo.security.impl;
 
 import org.eclipse.emf.cdo.security.Group;
+import org.eclipse.emf.cdo.security.Role;
 import org.eclipse.emf.cdo.security.SecurityPackage;
 import org.eclipse.emf.cdo.security.User;
 import org.eclipse.emf.cdo.security.UserPassword;
 
 import org.eclipse.emf.common.util.EList;
 import org.eclipse.emf.ecore.EClass;
+import org.eclipse.emf.ecore.EStructuralFeature;
+import org.eclipse.emf.ecore.InternalEObject;
+
+import java.util.HashSet;
+import java.util.Set;
 
 /**
  * <!-- begin-user-doc -->
@@ -26,6 +32,9 @@ import org.eclipse.emf.ecore.EClass;
  * The following features are implemented:
  * <ul>
  *   <li>{@link org.eclipse.emf.cdo.security.impl.UserImpl#getGroups <em>Groups</em>}</li>
+ *   <li>{@link org.eclipse.emf.cdo.security.impl.UserImpl#getAllGroups <em>All Groups</em>}</li>
+ *   <li>{@link org.eclipse.emf.cdo.security.impl.UserImpl#getAllRoles <em>All Roles</em>}</li>
+ *   <li>{@link org.eclipse.emf.cdo.security.impl.UserImpl#getLabel <em>Label</em>}</li>
  *   <li>{@link org.eclipse.emf.cdo.security.impl.UserImpl#getFirstName <em>First Name</em>}</li>
  *   <li>{@link org.eclipse.emf.cdo.security.impl.UserImpl#getLastName <em>Last Name</em>}</li>
  *   <li>{@link org.eclipse.emf.cdo.security.impl.UserImpl#getEmail <em>Email</em>}</li>
@@ -38,6 +47,64 @@ import org.eclipse.emf.ecore.EClass;
  */
 public class UserImpl extends AssigneeImpl implements User
 {
+  private EList<Group> allGroups = new CachedList<Group>()
+  {
+    @Override
+    protected InternalEObject getOwner()
+    {
+      return UserImpl.this;
+    }
+
+    @Override
+    protected EStructuralFeature getFeature()
+    {
+      return SecurityPackage.Literals.USER__ALL_GROUPS;
+    }
+
+    @Override
+    protected Object[] getData()
+    {
+      Set<Group> result = new HashSet<Group>();
+
+      for (Group group : getGroups())
+      {
+        result.add(group);
+        result.addAll(group.getAllInheritedGroups());
+      }
+
+      return result.toArray();
+    }
+  };
+
+  private EList<Role> allRoles = new CachedList<Role>()
+  {
+    @Override
+    protected InternalEObject getOwner()
+    {
+      return UserImpl.this;
+    }
+
+    @Override
+    protected EStructuralFeature getFeature()
+    {
+      return SecurityPackage.Literals.USER__ALL_ROLES;
+    }
+
+    @Override
+    protected Object[] getData()
+    {
+      Set<Role> result = new HashSet<Role>();
+      result.addAll(getRoles());
+
+      for (Group group : getAllGroups())
+      {
+        result.addAll(group.getAllRoles());
+      }
+
+      return result.toArray();
+    }
+  };
+
   /**
    * <!-- begin-user-doc -->
    * <!-- end-user-doc -->
@@ -73,6 +140,36 @@ public class UserImpl extends AssigneeImpl implements User
   /**
    * <!-- begin-user-doc -->
    * <!-- end-user-doc -->
+   * @generated NOT
+   */
+  public EList<Group> getAllGroups()
+  {
+    return allGroups;
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated NOT
+   */
+  public EList<Role> getAllRoles()
+  {
+    return allRoles;
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public String getLabel()
+  {
+    return (String)eGet(SecurityPackage.Literals.USER__LABEL, true);
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
    * @generated
    */
   public String getFirstName()
diff --git a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/util/SecurityAdapterFactory.java b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/util/SecurityAdapterFactory.java
index 33737ed051..35cfea28c1 100644
--- a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/util/SecurityAdapterFactory.java
+++ b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/util/SecurityAdapterFactory.java
@@ -27,6 +27,8 @@ import org.eclipse.emf.common.notify.Notifier;
 import org.eclipse.emf.common.notify.impl.AdapterFactoryImpl;
 import org.eclipse.emf.ecore.EObject;
 
+//import org.eclipse.emf.cdo.security.*;
+
 /**
  * <!-- begin-user-doc -->
  * The <b>Adapter Factory</b> for the model.
diff --git a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/util/SecuritySwitch.java b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/util/SecuritySwitch.java
index 0ffc6fb0d9..02ca779e9e 100644
--- a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/util/SecuritySwitch.java
+++ b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/util/SecuritySwitch.java
@@ -27,6 +27,8 @@ import org.eclipse.emf.ecore.EObject;
 
 import java.util.List;
 
+//import org.eclipse.emf.cdo.security.*;
+
 /**
  * <!-- begin-user-doc -->
  * The <b>Switch</b> for the model's inheritance hierarchy.
@@ -112,13 +114,9 @@ public class SecuritySwitch<T>
       SecurityElement securityElement = (SecurityElement)theEObject;
       T result = caseSecurityElement(securityElement);
       if (result == null)
-      {
         result = caseModelElement(securityElement);
-      }
       if (result == null)
-      {
         result = defaultCase(theEObject);
-      }
       return result;
     }
     case SecurityPackage.SECURITY_ITEM:
@@ -126,17 +124,11 @@ public class SecuritySwitch<T>
       SecurityItem securityItem = (SecurityItem)theEObject;
       T result = caseSecurityItem(securityItem);
       if (result == null)
-      {
         result = caseSecurityElement(securityItem);
-      }
       if (result == null)
-      {
         result = caseModelElement(securityItem);
-      }
       if (result == null)
-      {
         result = defaultCase(theEObject);
-      }
       return result;
     }
     case SecurityPackage.REALM:
@@ -144,17 +136,11 @@ public class SecuritySwitch<T>
       Realm realm = (Realm)theEObject;
       T result = caseRealm(realm);
       if (result == null)
-      {
         result = caseSecurityElement(realm);
-      }
       if (result == null)
-      {
         result = caseModelElement(realm);
-      }
       if (result == null)
-      {
         result = defaultCase(theEObject);
-      }
       return result;
     }
     case SecurityPackage.DIRECTORY:
@@ -162,21 +148,13 @@ public class SecuritySwitch<T>
       Directory directory = (Directory)theEObject;
       T result = caseDirectory(directory);
       if (result == null)
-      {
         result = caseSecurityItem(directory);
-      }
       if (result == null)
-      {
         result = caseSecurityElement(directory);
-      }
       if (result == null)
-      {
         result = caseModelElement(directory);
-      }
       if (result == null)
-      {
         result = defaultCase(theEObject);
-      }
       return result;
     }
     case SecurityPackage.ROLE:
@@ -184,21 +162,13 @@ public class SecuritySwitch<T>
       Role role = (Role)theEObject;
       T result = caseRole(role);
       if (result == null)
-      {
         result = caseSecurityItem(role);
-      }
       if (result == null)
-      {
         result = caseSecurityElement(role);
-      }
       if (result == null)
-      {
         result = caseModelElement(role);
-      }
       if (result == null)
-      {
         result = defaultCase(theEObject);
-      }
       return result;
     }
     case SecurityPackage.ASSIGNEE:
@@ -206,21 +176,13 @@ public class SecuritySwitch<T>
       Assignee assignee = (Assignee)theEObject;
       T result = caseAssignee(assignee);
       if (result == null)
-      {
         result = caseSecurityItem(assignee);
-      }
       if (result == null)
-      {
         result = caseSecurityElement(assignee);
-      }
       if (result == null)
-      {
         result = caseModelElement(assignee);
-      }
       if (result == null)
-      {
         result = defaultCase(theEObject);
-      }
       return result;
     }
     case SecurityPackage.GROUP:
@@ -228,25 +190,15 @@ public class SecuritySwitch<T>
       Group group = (Group)theEObject;
       T result = caseGroup(group);
       if (result == null)
-      {
         result = caseAssignee(group);
-      }
       if (result == null)
-      {
         result = caseSecurityItem(group);
-      }
       if (result == null)
-      {
         result = caseSecurityElement(group);
-      }
       if (result == null)
-      {
         result = caseModelElement(group);
-      }
       if (result == null)
-      {
         result = defaultCase(theEObject);
-      }
       return result;
     }
     case SecurityPackage.USER:
@@ -254,25 +206,15 @@ public class SecuritySwitch<T>
       User user = (User)theEObject;
       T result = caseUser(user);
       if (result == null)
-      {
         result = caseAssignee(user);
-      }
       if (result == null)
-      {
         result = caseSecurityItem(user);
-      }
       if (result == null)
-      {
         result = caseSecurityElement(user);
-      }
       if (result == null)
-      {
         result = caseModelElement(user);
-      }
       if (result == null)
-      {
         result = defaultCase(theEObject);
-      }
       return result;
     }
     case SecurityPackage.USER_PASSWORD:
@@ -280,9 +222,7 @@ public class SecuritySwitch<T>
       UserPassword userPassword = (UserPassword)theEObject;
       T result = caseUserPassword(userPassword);
       if (result == null)
-      {
         result = defaultCase(theEObject);
-      }
       return result;
     }
     default: