diff --git a/scm-webapp/src/main/java/sonia/scm/security/Groups.java b/scm-core/src/main/java/sonia/scm/group/GroupNames.java
similarity index 70%
rename from scm-webapp/src/main/java/sonia/scm/security/Groups.java
rename to scm-core/src/main/java/sonia/scm/group/GroupNames.java
index be4504f61a..379c7ae0eb 100644
--- a/scm-webapp/src/main/java/sonia/scm/security/Groups.java
+++ b/scm-core/src/main/java/sonia/scm/group/GroupNames.java
@@ -29,7 +29,11 @@
 
 
 
-package sonia.scm.security;
+package sonia.scm.group;
+
+//~--- non-JDK imports --------------------------------------------------------
+
+import com.google.common.collect.Lists;
 
 //~--- JDK imports ------------------------------------------------------------
 
@@ -40,14 +44,16 @@ import java.util.Collections;
 import java.util.Iterator;
 
 /**
+ * This class represents all associated groups for a user.
  *
  * @author Sebastian Sdorra
+ * @since 1.21
  */
-public class Groups implements Serializable, Iterable<String>
+public class GroupNames implements Serializable, Iterable<String>
 {
 
   /** Field description */
-  private static final long serialVersionUID = -4152799570939669716L;
+  private static final long serialVersionUID = 8615685985213897947L;
 
   //~--- constructors ---------------------------------------------------------
 
@@ -55,15 +61,40 @@ public class Groups implements Serializable, Iterable<String>
    * Constructs ...
    *
    *
-   * @param groups
+   * @param collection
    */
-  public Groups(Collection<String> groups)
+  public GroupNames(Collection<String> collection)
   {
-    this.groups = groups;
+    this.collection = Collections.unmodifiableCollection(collection);
+  }
+
+  /**
+   * Constructs ...
+   *
+   *
+   * @param groupName
+   * @param groupNames
+   */
+  public GroupNames(String groupName, String... groupNames)
+  {
+    this.collection = Lists.asList(groupName, groupNames);
   }
 
   //~--- methods --------------------------------------------------------------
 
+  /**
+   * Method description
+   *
+   *
+   * @param groupName
+   *
+   * @return
+   */
+  public boolean contains(String groupName)
+  {
+    return collection.contains(groupName);
+  }
+
   /**
    * Method description
    *
@@ -73,7 +104,7 @@ public class Groups implements Serializable, Iterable<String>
   @Override
   public Iterator<String> iterator()
   {
-    return getGroups().iterator();
+    return collection.iterator();
   }
 
   //~--- get methods ----------------------------------------------------------
@@ -84,18 +115,13 @@ public class Groups implements Serializable, Iterable<String>
    *
    * @return
    */
-  public Collection<String> getGroups()
+  public Collection<String> getCollection()
   {
-    if (groups == null)
-    {
-      groups = Collections.EMPTY_LIST;
-    }
-
-    return groups;
+    return collection;
   }
 
   //~--- fields ---------------------------------------------------------------
 
   /** Field description */
-  private Collection<String> groups;
+  private Collection<String> collection;
 }
diff --git a/scm-webapp/src/main/java/sonia/scm/api/rest/resources/AuthenticationResource.java b/scm-webapp/src/main/java/sonia/scm/api/rest/resources/AuthenticationResource.java
index 3dec0e2d01..08b6932f72 100644
--- a/scm-webapp/src/main/java/sonia/scm/api/rest/resources/AuthenticationResource.java
+++ b/scm-webapp/src/main/java/sonia/scm/api/rest/resources/AuthenticationResource.java
@@ -53,8 +53,8 @@ import sonia.scm.SCMContextProvider;
 import sonia.scm.ScmClientConfig;
 import sonia.scm.ScmState;
 import sonia.scm.config.ScmConfiguration;
+import sonia.scm.group.GroupNames;
 import sonia.scm.repository.RepositoryManager;
-import sonia.scm.security.Groups;
 import sonia.scm.security.ScmAuthenticationToken;
 import sonia.scm.user.User;
 import sonia.scm.user.UserManager;
@@ -290,9 +290,9 @@ public class AuthenticationResource
   {
     PrincipalCollection collection = subject.getPrincipals();
     User user = collection.oneByType(User.class);
-    Groups groups = collection.oneByType(Groups.class);
+    GroupNames groups = collection.oneByType(GroupNames.class);
 
-    return new ScmState(contextProvider, user, groups.getGroups(),
+    return new ScmState(contextProvider, user, groups.getCollection(),
       repositoryManger.getConfiguredTypes(), userManager.getDefaultType(),
       new ScmClientConfig(configuration));
   }
diff --git a/scm-webapp/src/main/java/sonia/scm/security/ScmRealm.java b/scm-webapp/src/main/java/sonia/scm/security/ScmRealm.java
index 047c7d26fd..e87c1f70bd 100644
--- a/scm-webapp/src/main/java/sonia/scm/security/ScmRealm.java
+++ b/scm-webapp/src/main/java/sonia/scm/security/ScmRealm.java
@@ -60,6 +60,7 @@ import sonia.scm.cache.CacheManager;
 import sonia.scm.config.ScmConfiguration;
 import sonia.scm.group.Group;
 import sonia.scm.group.GroupManager;
+import sonia.scm.group.GroupNames;
 import sonia.scm.repository.Permission;
 import sonia.scm.repository.PermissionType;
 import sonia.scm.repository.Repository;
@@ -273,7 +274,7 @@ public class ScmRealm extends AuthorizingRealm
         logger.trace("coullect AuthorizationInfo for user {}", user.getName());
       }
 
-      Groups groups = principals.oneByType(Groups.class);
+      GroupNames groups = principals.oneByType(GroupNames.class);
 
       info = createAuthorizationInfo(user, groups);
     }
@@ -545,7 +546,7 @@ public class ScmRealm extends AuthorizingRealm
      */
     collection.add(user.getId(), NAME);
     collection.add(user, NAME);
-    collection.add(new Groups(groups), NAME);
+    collection.add(new GroupNames(groups), NAME);
 
     return new SimpleAuthenticationInfo(collection, token.getPassword());
   }
@@ -559,7 +560,8 @@ public class ScmRealm extends AuthorizingRealm
    *
    * @return
    */
-  private AuthorizationInfo createAuthorizationInfo(User user, Groups groups)
+  private AuthorizationInfo createAuthorizationInfo(User user,
+    GroupNames groups)
   {
     Set<String> roles = Sets.newHashSet();
     List<org.apache.shiro.authz.Permission> permissions = null;
diff --git a/scm-webapp/src/main/java/sonia/scm/web/security/BasicSecurityContext.java b/scm-webapp/src/main/java/sonia/scm/web/security/BasicSecurityContext.java
index 124aa2a488..96192230a6 100644
--- a/scm-webapp/src/main/java/sonia/scm/web/security/BasicSecurityContext.java
+++ b/scm-webapp/src/main/java/sonia/scm/web/security/BasicSecurityContext.java
@@ -46,7 +46,6 @@ import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
 import sonia.scm.config.ScmConfiguration;
-import sonia.scm.security.Groups;
 import sonia.scm.security.ScmAuthenticationToken;
 import sonia.scm.user.User;
 import sonia.scm.user.UserManager;
@@ -59,6 +58,7 @@ import java.util.Collections;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import javax.servlet.http.HttpSession;
+import sonia.scm.group.GroupNames;
 
 /**
  *
@@ -167,13 +167,13 @@ public class BasicSecurityContext implements WebSecurityContext
   public Collection<String> getGroups()
   {
     Subject subject = SecurityUtils.getSubject();
-    Groups groups = getPrincipal(Groups.class);
+    GroupNames groups = getPrincipal(GroupNames.class);
 
     Collection<String> groupCollection = null;
 
     if (groups != null)
     {
-      groupCollection = groups.getGroups();
+      groupCollection = groups.getCollection();
     }
     else
     {