diff --git a/scm-core/src/main/java/sonia/scm/security/GroupCollector.java b/scm-core/src/main/java/sonia/scm/security/GroupCollector.java
index 06ac590a9a..6c9bf2e659 100644
--- a/scm-core/src/main/java/sonia/scm/security/GroupCollector.java
+++ b/scm-core/src/main/java/sonia/scm/security/GroupCollector.java
@@ -1,70 +1,5 @@
 package sonia.scm.security;
 
-import com.google.common.collect.ImmutableSet;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import sonia.scm.cache.Cache;
-import sonia.scm.cache.CacheManager;
-import sonia.scm.group.Group;
-import sonia.scm.group.GroupDAO;
-import sonia.scm.group.GroupNames;
-
-import java.util.Set;
-
-/**
- * Collect groups for a certain principal.
- * <strong>Warning</strong>: The class is only for internal use and should never used directly.
- */
-class GroupCollector {
-
-  private static final Logger LOG = LoggerFactory.getLogger(GroupCollector.class);
-
-  /** Field description */
-  public static final String CACHE_NAME = "sonia.cache.externalGroups";
-
-  /** Field description */
-  private final Cache<String, Set> cache;
-  private Set<GroupResolver> groupResolvers;
-
-  private final GroupDAO groupDAO;
-
-  GroupCollector(GroupDAO groupDAO, CacheManager cacheManager, Set<GroupResolver> groupResolvers) {
-    this.groupDAO = groupDAO;
-    this.cache  = cacheManager.getCache(CACHE_NAME);
-    this.groupResolvers = groupResolvers;
-  }
-
-  Iterable<String> collect(String principal) {
-
-    Set<String> externalGroups = cache.get(principal);
-
-    if (externalGroups == null) {
-      ImmutableSet.Builder<String> newExternalGroups = ImmutableSet.builder();
-
-      for (GroupResolver groupResolver : groupResolvers) {
-       Iterable<String> groups = groupResolver.resolveGroups(principal);
-       groups.forEach(newExternalGroups::add);
-      }
-
-      cache.put(principal, newExternalGroups.build());
-    }
-
-    ImmutableSet.Builder<String> builder = ImmutableSet.builder();
-
-    builder.add(GroupNames.AUTHENTICATED);
-
-    for (String group : externalGroups) {
-      builder.add(group);
-    }
-
-    for (Group group : groupDAO.getAll()) {
-      if (group.isMember(principal)) {
-        builder.add(group.getName());
-      }
-    }
-
-    GroupNames groups = new GroupNames(builder.build());
-    LOG.debug("collected following groups for principal {}: {}", principal, groups);
-    return groups;
-  }
+public interface GroupCollector {
+  Iterable<String> collect(String principal);
 }
diff --git a/scm-webapp/src/main/java/sonia/scm/group/DefaultGroupCollector.java b/scm-webapp/src/main/java/sonia/scm/group/DefaultGroupCollector.java
new file mode 100644
index 0000000000..cdaf0eb7b2
--- /dev/null
+++ b/scm-webapp/src/main/java/sonia/scm/group/DefaultGroupCollector.java
@@ -0,0 +1,70 @@
+package sonia.scm.group;
+
+import com.google.common.collect.ImmutableSet;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import sonia.scm.cache.Cache;
+import sonia.scm.cache.CacheManager;
+import sonia.scm.security.GroupCollector;
+import sonia.scm.security.GroupResolver;
+
+import java.util.Set;
+
+/**
+ * Collect groups for a certain principal.
+ * <strong>Warning</strong>: The class is only for internal use and should never used directly.
+ */
+class DefaultGroupCollector implements GroupCollector {
+
+  private static final Logger LOG = LoggerFactory.getLogger(DefaultGroupCollector.class);
+
+  /** Field description */
+  public static final String CACHE_NAME = "sonia.cache.externalGroups";
+
+  /** Field description */
+  private final Cache<String, Set<String>> cache;
+  private Set<GroupResolver> groupResolvers;
+
+  private final GroupDAO groupDAO;
+
+  DefaultGroupCollector(GroupDAO groupDAO, CacheManager cacheManager, Set<GroupResolver> groupResolvers) {
+    this.groupDAO = groupDAO;
+    this.cache  = cacheManager.getCache(CACHE_NAME);
+    this.groupResolvers = groupResolvers;
+  }
+
+  @Override
+  public Iterable<String> collect(String principal) {
+
+    Set<String> externalGroups = cache.get(principal);
+
+    if (externalGroups == null) {
+      ImmutableSet.Builder<String> newExternalGroups = ImmutableSet.builder();
+
+      for (GroupResolver groupResolver : groupResolvers) {
+       Iterable<String> groups = groupResolver.resolveGroups(principal);
+       groups.forEach(newExternalGroups::add);
+      }
+
+      cache.put(principal, newExternalGroups.build());
+    }
+
+    ImmutableSet.Builder<String> builder = ImmutableSet.builder();
+
+    builder.add(GroupNames.AUTHENTICATED);
+
+    for (String group : externalGroups) {
+      builder.add(group);
+    }
+
+    for (Group group : groupDAO.getAll()) {
+      if (group.isMember(principal)) {
+        builder.add(group.getName());
+      }
+    }
+
+    GroupNames groups = new GroupNames(builder.build());
+    LOG.debug("collected following groups for principal {}: {}", principal, groups);
+    return groups;
+  }
+}
diff --git a/scm-core/src/test/java/sonia/scm/security/GroupCollectorTest.java b/scm-webapp/src/test/java/sonia/scm/group/GroupCollectorTest.java
similarity index 74%
rename from scm-core/src/test/java/sonia/scm/security/GroupCollectorTest.java
rename to scm-webapp/src/test/java/sonia/scm/group/GroupCollectorTest.java
index 3fb59d1614..4bdcd2694a 100644
--- a/scm-core/src/test/java/sonia/scm/security/GroupCollectorTest.java
+++ b/scm-webapp/src/test/java/sonia/scm/group/GroupCollectorTest.java
@@ -1,6 +1,5 @@
-package sonia.scm.security;
+package sonia.scm.group;
 
-import com.google.common.collect.ImmutableList;
 import com.google.common.collect.Lists;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Nested;
@@ -9,11 +8,8 @@ import org.junit.jupiter.api.extension.ExtendWith;
 import org.mockito.InjectMocks;
 import org.mockito.Mock;
 import org.mockito.junit.jupiter.MockitoExtension;
-import sonia.scm.group.Group;
-import sonia.scm.group.GroupDAO;
-import sonia.scm.group.GroupNames;
+import sonia.scm.security.GroupCollector;
 
-import java.util.Collections;
 import java.util.List;
 
 import static org.assertj.core.api.Assertions.assertThat;
@@ -30,7 +26,7 @@ class GroupCollectorTest {
 
   @Test
   void shouldAlwaysReturnAuthenticatedGroup() {
-    GroupNames groupNames = collector.collect("trillian", Collections.emptySet());
+    Iterable<String> groupNames = collector.collect("trillian");
     assertThat(groupNames).containsOnly("_authenticated");
   }
 
@@ -49,13 +45,13 @@ class GroupCollectorTest {
 
     @Test
     void shouldReturnGroupsFromDao() {
-      GroupNames groupNames = collector.collect("trillian", Collections.emptySet());
+      Iterable<String> groupNames = collector.collect("trillian");
       assertThat(groupNames).contains("_authenticated", "heartOfGold", "fjordsOfAfrican");
     }
 
     @Test
     void shouldCombineGivenWithDao() {
-      GroupNames groupNames = collector.collect("trillian", ImmutableList.of("awesome", "incredible"));
+      Iterable<String> groupNames = collector.collect("trillian");
       assertThat(groupNames).contains("_authenticated", "heartOfGold", "fjordsOfAfrican", "awesome", "incredible");
     }