diff --git a/doc/sphinx-guides/source/api/native-api.rst b/doc/sphinx-guides/source/api/native-api.rst
index 59af4f00eee..a28c1d43b45 100644
--- a/doc/sphinx-guides/source/api/native-api.rst
+++ b/doc/sphinx-guides/source/api/native-api.rst
@@ -125,12 +125,12 @@ List versions of the dataset::
 Show a version of the dataset. The Dataset also include any metadata blocks the data might have::
 
   GET http://$SERVER/api/datasets/$id/versions/$versionNumber?key=$apiKey
-  
-      
+
+
 Export the metadata of the current published version of a dataset in various formats see Note below::
 
     GET http://$SERVER/api/datasets/export?exporter=ddi&persistentId=$persistentId
-  
+
     Note: Supported exporters (export formats) are ddi, oai_ddi, dcterms, oai_dc, and dataverse_json.
 
 
@@ -163,9 +163,9 @@ To revert to the default logic, use ``:publicationDate`` as the ``$datasetFieldT
 Note that the dataset field used has to be a date field::
 
     PUT http://$SERVER/api/datasets/$id/citationdate?key=$apiKey
-    
+
 Restores the default logic of the field type to be used as the citation date. Same as ``PUT`` with ``:publicationDate`` body::
-    
+
     DELETE http://$SERVER/api/datasets/$id/citationdate?key=$apiKey
 
 List all the role assignments at the given dataset::
@@ -368,18 +368,29 @@ Toggles superuser mode on the ``AuthenticatedUser`` whose ``identifier`` (withou
 
     POST http://$SERVER/api/admin/superuser/$identifier
 
+List all role assignments of a role assignee (i.e. a user or a group)::
+
+    GET http://$SERVER/api/admin/assignments/assignees/$identifier
+
+Note that ``identifier`` can contain slashes (e.g. ``&ip/localhost-users``).
+
 IpGroups
 ^^^^^^^^
 
-List all the ip groups::
+Lists all the ip groups::
 
   GET http://$SERVER/api/admin/groups/ip
 
-Adds a new ip group. POST data should specify the group in JSON format. Examples are available at ``data/ipGroup1.json``. ::
+Adds a new ip group. POST data should specify the group in JSON format. Examples are available at the ``data`` folder. Using this method, an IP Group is always created, but its ``alias`` might be different than the one appearing in the
+JSON file, to ensure it is unique. ::
 
   POST http://$SERVER/api/admin/groups/ip
 
-Returns a the group in a JSON format. ``groupIdtf`` can either be the group id in the database (in case it is numeric), or the group alias. ::
+Creates or updates the ip group ``$groupAlias``. ::
+
+    POST http://$SERVER/api/admin/groups/ip/$groupAlias
+
+Returns a the group in a JSON format. ``$groupIdtf`` can either be the group id in the database (in case it is numeric), or the group alias. ::
 
   GET http://$SERVER/api/admin/groups/ip/$groupIdtf
 
diff --git a/scripts/api/data/ipGroup-all-ipv4.json b/scripts/api/data/ipGroup-all-ipv4.json
new file mode 100644
index 00000000000..c5ff32def44
--- /dev/null
+++ b/scripts/api/data/ipGroup-all-ipv4.json
@@ -0,0 +1,5 @@
+{
+  "alias":"all-ipv4",
+  "name":"IP group to match all IPv4 addresses",
+  "ranges" : [["0.0.0.0", "255.255.255.255"]]
+}
diff --git a/scripts/api/data/ipGroup3.json b/scripts/api/data/ipGroup-all.json
similarity index 100%
rename from scripts/api/data/ipGroup3.json
rename to scripts/api/data/ipGroup-all.json
diff --git a/scripts/api/data/ipGroup-localhost.json b/scripts/api/data/ipGroup-localhost.json
index 4a5f7facfef..4f8d2f708b2 100644
--- a/scripts/api/data/ipGroup-localhost.json
+++ b/scripts/api/data/ipGroup-localhost.json
@@ -1,6 +1,5 @@
 {
   "alias":"localhost",
   "name":"Localhost connections",
-  "ranges" : [["127.0.0.1", "127.0.0.1"],
-              ["::1", "::1"]]
+  "addresses": [ "::1", "127.0.0.1" ]
 }
diff --git a/scripts/api/data/ipGroup-single-IPv4.json b/scripts/api/data/ipGroup-single-IPv4.json
new file mode 100644
index 00000000000..515c512bcd1
--- /dev/null
+++ b/scripts/api/data/ipGroup-single-IPv4.json
@@ -0,0 +1,5 @@
+{
+  "alias":"singleIPv4",
+  "name":"Single IPv4",
+  "addresses" : ["128.0.0.7"]
+}
diff --git a/scripts/api/data/ipGroup-single-IPv6.json b/scripts/api/data/ipGroup-single-IPv6.json
new file mode 100644
index 00000000000..73eaa8e60a1
--- /dev/null
+++ b/scripts/api/data/ipGroup-single-IPv6.json
@@ -0,0 +1,5 @@
+{
+  "alias":"singleIPv6",
+  "name":"Single IPv6",
+  "addresses" : ["aa:bb:cc:dd:ee:ff::1"]
+}
diff --git a/scripts/api/data/ipGroupDuplicate-v1.json b/scripts/api/data/ipGroupDuplicate-v1.json
new file mode 100644
index 00000000000..eda0c8eb49b
--- /dev/null
+++ b/scripts/api/data/ipGroupDuplicate-v1.json
@@ -0,0 +1,7 @@
+{
+  "alias":"ipGroup-dup",
+  "name":"IP Group with duplicate files (1)",
+  "description":"This is the FIRST version of the group",
+  "ranges" : [["60.0.0.0", "60.0.0.255"],
+              ["60::1", "60::ffff"]]
+}
diff --git a/scripts/api/data/ipGroupDuplicate-v2.json b/scripts/api/data/ipGroupDuplicate-v2.json
new file mode 100644
index 00000000000..8db88e97fe7
--- /dev/null
+++ b/scripts/api/data/ipGroupDuplicate-v2.json
@@ -0,0 +1,7 @@
+{
+  "alias":"ipGroup-dup",
+  "name":"IP Group with duplicate files-v2",
+  "description":"This is the second version of the group",
+  "ranges" : [["70.0.0.0", "70.0.0.255"],
+              ["70::1", "70::ffff"]]
+}
diff --git a/scripts/issues/1380/01-add.localhost.sh b/scripts/issues/1380/01-add.localhost.sh
new file mode 100755
index 00000000000..331011d5fa2
--- /dev/null
+++ b/scripts/issues/1380/01-add.localhost.sh
@@ -0,0 +1,2 @@
+# Add the localhost group to the system.
+curl -X POST -H"Content-Type:application/json" -d@../../api/data/ipGroup-localhost.json  localhost:8080/api/admin/groups/ip
diff --git a/scripts/issues/1380/02-build-dv-structure.sh b/scripts/issues/1380/02-build-dv-structure.sh
new file mode 100755
index 00000000000..f0936e3cf69
--- /dev/null
+++ b/scripts/issues/1380/02-build-dv-structure.sh
@@ -0,0 +1,12 @@
+#!/bin/bash
+
+echo Run this after running setup-users.sh, and making Pete an
+echo admin on the root dataverse.
+
+
+PETE=$(grep :result: users.out | grep Pete | cut -f4 -d: | tr -d \ )
+UMA=$(grep :result: users.out | grep Uma | cut -f4 -d: | tr -d \ )
+
+pushd ../../api
+./setup-dvs.sh $PETE $UMA
+popd
diff --git a/scripts/issues/1380/add-ip-group.sh b/scripts/issues/1380/add-ip-group.sh
new file mode 100755
index 00000000000..2fba944807c
--- /dev/null
+++ b/scripts/issues/1380/add-ip-group.sh
@@ -0,0 +1,4 @@
+#!/bin/bash
+
+# Add the passed group to the system.
+curl -X POST -H"Content-Type:application/json" -d@../../api/data/$1  localhost:8080/api/admin/groups/ip
diff --git a/scripts/issues/1380/add-user b/scripts/issues/1380/add-user
new file mode 100755
index 00000000000..1781181bb79
--- /dev/null
+++ b/scripts/issues/1380/add-user
@@ -0,0 +1,3 @@
+#!/bin/bash
+# add-user dv group user api-token
+curl -H "Content-type:application/json" -X POST -d"[$3]" localhost:8080/api/dataverses/$1/groups/$2/roleAssignees?key=$4
diff --git a/scripts/issues/1380/data/3-eg1.json b/scripts/issues/1380/data/3-eg1.json
new file mode 100644
index 00000000000..a874d69a2e8
--- /dev/null
+++ b/scripts/issues/1380/data/3-eg1.json
@@ -0,0 +1 @@
+["&explicit/3-eg1"]
diff --git a/scripts/issues/1380/data/guest.json b/scripts/issues/1380/data/guest.json
new file mode 100644
index 00000000000..3e4188a7167
--- /dev/null
+++ b/scripts/issues/1380/data/guest.json
@@ -0,0 +1 @@
+[":guest"]
diff --git a/scripts/issues/1380/data/locals.json b/scripts/issues/1380/data/locals.json
new file mode 100644
index 00000000000..8bb5e3e4162
--- /dev/null
+++ b/scripts/issues/1380/data/locals.json
@@ -0,0 +1 @@
+["&ip/localhost"]
diff --git a/scripts/issues/1380/data/pete.json b/scripts/issues/1380/data/pete.json
new file mode 100644
index 00000000000..298e813d2bc
--- /dev/null
+++ b/scripts/issues/1380/data/pete.json
@@ -0,0 +1 @@
+["@pete"]
diff --git a/scripts/issues/1380/data/uma.json b/scripts/issues/1380/data/uma.json
new file mode 100644
index 00000000000..3caf8c5c9cc
--- /dev/null
+++ b/scripts/issues/1380/data/uma.json
@@ -0,0 +1 @@
+["@uma"]
diff --git a/scripts/issues/1380/db-list-dvs b/scripts/issues/1380/db-list-dvs
new file mode 100755
index 00000000000..4161f7fdd03
--- /dev/null
+++ b/scripts/issues/1380/db-list-dvs
@@ -0,0 +1 @@
+psql dvndb -c "select dvobject.id, name, alias, owner_id from dvobject inner join dataverse on dvobject.id = dataverse.id"
diff --git a/scripts/issues/1380/delete-ip-group b/scripts/issues/1380/delete-ip-group
new file mode 100755
index 00000000000..b6138d95024
--- /dev/null
+++ b/scripts/issues/1380/delete-ip-group
@@ -0,0 +1,9 @@
+#/bin/bahx
+if [ $# -eq 0 ]
+  then
+    echo "Please provide IP group id"
+    echo "e.g $0 845"
+    exit 1
+fi
+
+curl -X DELETE http://localhost:8080/api/admin/groups/ip/$1
diff --git a/scripts/issues/1380/dvs.gv b/scripts/issues/1380/dvs.gv
new file mode 100644
index 00000000000..526066000a2
--- /dev/null
+++ b/scripts/issues/1380/dvs.gv
@@ -0,0 +1,19 @@
+digraph {
+d1[label="Root"]
+d2[label="Top dataverse of Pete"]
+d3[label="Pete's public place"]
+d4[label="Pete's restricted data"]
+d5[label="Pete's secrets"]
+d6[label="Top dataverse of Uma"]
+d7[label="Uma's first"]
+d8[label="Uma's restricted"]
+
+d1 -> d2
+d2 -> d3
+d2 -> d4
+d2 -> d5
+d1 -> d6
+d6 -> d7
+d6 -> d8
+
+}
diff --git a/scripts/issues/1380/dvs.pdf b/scripts/issues/1380/dvs.pdf
new file mode 100644
index 00000000000..5169f449420
Binary files /dev/null and b/scripts/issues/1380/dvs.pdf differ
diff --git a/scripts/issues/1380/explicitGroup1.json b/scripts/issues/1380/explicitGroup1.json
new file mode 100644
index 00000000000..337a0b62dcb
--- /dev/null
+++ b/scripts/issues/1380/explicitGroup1.json
@@ -0,0 +1,5 @@
+{
+ "description":"Sample Explicit Group",
+ "displayName":"Close Collaborators",
+ "aliasInOwner":"eg1"
+}
diff --git a/scripts/issues/1380/explicitGroup2.json b/scripts/issues/1380/explicitGroup2.json
new file mode 100644
index 00000000000..fbac263665c
--- /dev/null
+++ b/scripts/issues/1380/explicitGroup2.json
@@ -0,0 +1,5 @@
+{
+ "description":"Sample Explicit Group",
+ "displayName":"Not-So-Close Collaborators",
+ "aliasInOwner":"eg2"
+}
diff --git a/scripts/issues/1380/keys.txt b/scripts/issues/1380/keys.txt
new file mode 100644
index 00000000000..9dc47d356c1
--- /dev/null
+++ b/scripts/issues/1380/keys.txt
@@ -0,0 +1,3 @@
+Keys for P e t e and U m a. Produced by running setup-all.sh from the /scripts/api folder.
+Pete:757a6493-456a-4bf0-943e-9b559d551a3f
+Uma:8797f19b-b8aa-4f96-a789-1b99506f2eab
diff --git a/scripts/issues/1380/list-groups-for b/scripts/issues/1380/list-groups-for
new file mode 100755
index 00000000000..063b92c9b6a
--- /dev/null
+++ b/scripts/issues/1380/list-groups-for
@@ -0,0 +1,2 @@
+#!/bin/bash
+curl -s -X GET http://localhost:8080/api/test/explicitGroups/$1 | jq .
diff --git a/scripts/issues/1380/list-ip-groups.sh b/scripts/issues/1380/list-ip-groups.sh
new file mode 100755
index 00000000000..fba29cced4e
--- /dev/null
+++ b/scripts/issues/1380/list-ip-groups.sh
@@ -0,0 +1,2 @@
+#!/bin/bash
+curl -X GET http://localhost:8080/api/admin/groups/ip | jq .
diff --git a/scripts/issues/1380/truth-table.numbers b/scripts/issues/1380/truth-table.numbers
new file mode 100644
index 00000000000..86f67386fbb
Binary files /dev/null and b/scripts/issues/1380/truth-table.numbers differ
diff --git a/scripts/issues/1380/users.out b/scripts/issues/1380/users.out
new file mode 100644
index 00000000000..337b9e2ce01
--- /dev/null
+++ b/scripts/issues/1380/users.out
@@ -0,0 +1,6 @@
+{"status":"OK","data":{"user":{"id":4,"firstName":"Gabbi","lastName":"Guest","userName":"gabbi","affiliation":"low","position":"A Guest","email":"gabbi@malinator.com"},"authenticatedUser":{"id":4,"identifier":"@gabbi","displayName":"Gabbi Guest","firstName":"Gabbi","lastName":"Guest","email":"gabbi@malinator.com","superuser":false,"affiliation":"low","position":"A Guest","persistentUserId":"gabbi","authenticationProviderId":"builtin"},"apiToken":"d1940786-c315-491e-9812-a8ff809289cc"}}
+{"status":"OK","data":{"user":{"id":5,"firstName":"Cathy","lastName":"Collaborator","userName":"cathy","affiliation":"mid","position":"Data Scientist","email":"cathy@malinator.com"},"authenticatedUser":{"id":5,"identifier":"@cathy","displayName":"Cathy Collaborator","firstName":"Cathy","lastName":"Collaborator","email":"cathy@malinator.com","superuser":false,"affiliation":"mid","position":"Data Scientist","persistentUserId":"cathy","authenticationProviderId":"builtin"},"apiToken":"0ddfcb1e-fb51-4ce7-88ab-308b23e13e9a"}}
+{"status":"OK","data":{"user":{"id":6,"firstName":"Nick","lastName":"NSA","userName":"nick","affiliation":"gov","position":"Signals Intelligence","email":"nick@malinator.com"},"authenticatedUser":{"id":6,"identifier":"@nick","displayName":"Nick NSA","firstName":"Nick","lastName":"NSA","email":"nick@malinator.com","superuser":false,"affiliation":"gov","position":"Signals Intelligence","persistentUserId":"nick","authenticationProviderId":"builtin"},"apiToken":"6d74745d-1733-459a-ae29-422110056ec0"}}
+reporting API keys
+:result: Pete's key is: 757a6493-456a-4bf0-943e-9b559d551a3f
+:result: Uma's key is: 8797f19b-b8aa-4f96-a789-1b99506f2eab
\ No newline at end of file
diff --git a/scripts/search/tests/ipgroup-add b/scripts/search/tests/ipgroup-add
index 8033b277258..d41679fd188 100755
--- a/scripts/search/tests/ipgroup-add
+++ b/scripts/search/tests/ipgroup-add
@@ -1,5 +1,5 @@
 #!/bin/sh
 . scripts/search/export-keys
-OUTPUT=`curl -s -X POST -d @scripts/api/data/ipGroup3.json http://localhost:8080/api/admin/groups/ip -H "Content-type:application/json"`
+OUTPUT=`curl -s -X POST -d @scripts/api/data/ipGroup-all.json http://localhost:8080/api/admin/groups/ip -H "Content-type:application/json"`
 echo $OUTPUT
 echo $OUTPUT | jq .
diff --git a/src/main/java/edu/harvard/iq/dataverse/DataFile.java b/src/main/java/edu/harvard/iq/dataverse/DataFile.java
index 7faa8b485d5..057faf4211e 100644
--- a/src/main/java/edu/harvard/iq/dataverse/DataFile.java
+++ b/src/main/java/edu/harvard/iq/dataverse/DataFile.java
@@ -229,6 +229,11 @@ public String getOriginalFileFormat() {
         return null;
     }
 
+    @Override
+    public boolean isAncestorOf( DvObject other ) {
+        return equals(other);
+    }
+    
     /*
      * A user-friendly version of the "original format":
      */
diff --git a/src/main/java/edu/harvard/iq/dataverse/Dataset.java b/src/main/java/edu/harvard/iq/dataverse/Dataset.java
index 0acf76dc00e..39a953d0de7 100644
--- a/src/main/java/edu/harvard/iq/dataverse/Dataset.java
+++ b/src/main/java/edu/harvard/iq/dataverse/Dataset.java
@@ -654,5 +654,9 @@ public String getDisplayName() {
     protected boolean isPermissionRoot() {
         return false;
     }
-
+    
+    @Override
+    public boolean isAncestorOf( DvObject other ) {
+        return equals(other) || equals(other.getOwner());
+    }
 }
diff --git a/src/main/java/edu/harvard/iq/dataverse/DatasetPage.java b/src/main/java/edu/harvard/iq/dataverse/DatasetPage.java
index 882608dff45..55811ac8b1a 100644
--- a/src/main/java/edu/harvard/iq/dataverse/DatasetPage.java
+++ b/src/main/java/edu/harvard/iq/dataverse/DatasetPage.java
@@ -83,7 +83,6 @@
 
 import javax.faces.event.AjaxBehaviorEvent;
 
-import javax.faces.context.ExternalContext;
 import org.apache.commons.lang.StringEscapeUtils;
 
 import org.primefaces.component.tabview.TabView;
@@ -187,7 +186,6 @@ public enum DisplayMode {
     private List<Template> dataverseTemplates = new ArrayList();
     private Template defaultTemplate;
     private Template selectedTemplate;
-    private String globalId;
     private String persistentId;
     private String version;
     private String protocol = "";
@@ -322,11 +320,7 @@ public Long getMaxFileUploadSizeInBytes(){
     }
     
     public boolean isUnlimitedUploadFileSize(){
-        
-        if (this.maxFileUploadSizeInBytes == null){
-            return true;
-        }
-        return false;
+        return (this.maxFileUploadSizeInBytes == null);
     }
 
     public boolean isMetadataExportEnabled() {
@@ -455,9 +449,8 @@ public boolean isNoDVsRemaining() {
      * Convenience method for "Download File" button display logic
      * 
      * Used by the dataset.xhtml render logic when listing files
-     *       > Assume user already has view access to the file list 
-     *         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^!!!
-     * 
+     * <b>Assumes user already has view access to the file list.</b>
+     *         
      * @param fileMetadata
      * @return boolean
      */
@@ -498,29 +491,13 @@ public boolean canDownloadFile(FileMetadata fileMetadata){
         }
         
         // --------------------------------------------------------------------
-        // Conditions (2) through (4) are for Restricted files
+        // Conditions (2) through (3) are for Restricted files
         // --------------------------------------------------------------------
         
         // --------------------------------------------------------------------
-        // (2) In Dataverse 4.3 and earlier we required that users be authenticated
-        // to download files, but in developing the Private URL feature, we have
-        // added a new subclass of "User" called "PrivateUrlUser" that returns false
-        // for isAuthenticated but that should be able to download restricted files
-        // when given the Member role (which includes the DownloadFile permission).
-        // This is consistent with how Builtin and Shib users (both are
-        // AuthenticatedUsers) can download restricted files when they are granted
-        // the Member role. For this reason condition 2 has been changed. Previously,
-        // we required isSessionUserAuthenticated to return true. Now we require
-        // that the User is not an instance of GuestUser, which is similar in
-        // spirit to the previous check.
-        // --------------------------------------------------------------------
-        if (session.getUser() instanceof GuestUser){
-            this.fileDownloadPermissionMap.put(fid, false);
-            return false;
-        }
-        
-        // --------------------------------------------------------------------
-        // (3) Does the User have DownloadFile Permission at the **Dataset** level 
+        // (2) Does the User have DownloadFile Permission at the **Dataset** level 
+        // Michael: Leaving this in for now, but shouldn't this be alredy resolved
+        //          by the premission system, given that files are never permission roots?
         // --------------------------------------------------------------------
         if (this.doesSessionUserHaveDataSetPermission(Permission.DownloadFile)){
             // Yes, save answer and return true
@@ -529,7 +506,7 @@ public boolean canDownloadFile(FileMetadata fileMetadata){
         }
   
         // --------------------------------------------------------------------
-        // (4) Does the user has DownloadFile permission on the DataFile            
+        // (3) Does the user has DownloadFile permission on the DataFile            
         // --------------------------------------------------------------------
         if (this.permissionService.on(fileMetadata.getDataFile()).has(Permission.DownloadFile)){
             this.fileDownloadPermissionMap.put(fid, true);
@@ -537,7 +514,7 @@ public boolean canDownloadFile(FileMetadata fileMetadata){
         }
         
         // --------------------------------------------------------------------
-        // (6) No download....
+        // (4) No download for you! Come back with permissions!
         // --------------------------------------------------------------------
         this.fileDownloadPermissionMap.put(fid, false);
        
@@ -558,7 +535,7 @@ public boolean isThumbnailAvailable(FileMetadata fileMetadata) {
     
     // Another convenience method - to cache Update Permission on the dataset: 
     public boolean canUpdateDataset() {
-        return permissionsWrapper.canUpdateDataset(this.session.getUser(), this.dataset);
+        return permissionsWrapper.canUpdateDataset(dvRequestService.getDataverseRequest(), this.dataset);
     }
     
     public boolean canPublishDataverse() {
@@ -579,13 +556,9 @@ public boolean canPublishDataverse() {
     //}
     
     public boolean canViewUnpublishedDataset() {
-        return permissionsWrapper.canViewUnpublishedDataset(this.session.getUser(), this.dataset);
-        //return doesSessionUserHaveDataSetPermission(Permission.ViewUnpublishedDataset);
+        return permissionsWrapper.canViewUnpublishedDataset( dvRequestService.getDataverseRequest(), dataset);
     }
     
-    private Boolean sessionUserAuthenticated = null;
-    
-    
     /* 
      * 4.2.1 optimization. 
      * HOWEVER, this doesn't appear to be saving us anything! 
@@ -593,28 +566,7 @@ public boolean canViewUnpublishedDataset() {
      * every time; it doesn't do any new db lookups. 
     */
     public boolean isSessionUserAuthenticated() {
-        logger.fine("entering isSessionUserAuthenticated;");
-        if (sessionUserAuthenticated != null) {
-            logger.fine("using cached isSessionUserAuthenticated;");
-            
-            return sessionUserAuthenticated;
-        }
-        
-        if (session == null) {
-            return false;
-        }
-        
-        if (session.getUser() == null) {
-            return false;
-        }
-        
-        if (session.getUser().isAuthenticated()) {
-            sessionUserAuthenticated = true; 
-            return true;
-        }
-        
-        sessionUserAuthenticated = false;
-        return false;
+        return session.getUser().isAuthenticated();
     }
     
     /**
diff --git a/src/main/java/edu/harvard/iq/dataverse/Dataverse.java b/src/main/java/edu/harvard/iq/dataverse/Dataverse.java
index cb04cfb0d9a..44f0a7a77b4 100644
--- a/src/main/java/edu/harvard/iq/dataverse/Dataverse.java
+++ b/src/main/java/edu/harvard/iq/dataverse/Dataverse.java
@@ -32,7 +32,6 @@
 import javax.validation.constraints.Size;
 import org.hibernate.validator.constraints.NotBlank;
 import org.hibernate.validator.constraints.NotEmpty;
-import org.hibernate.validator.constraints.URL;
 
 /**
  *
@@ -734,6 +733,14 @@ public boolean isPermissionRoot() {
     public void setPermissionRoot(boolean permissionRoot) {
         this.permissionRoot = permissionRoot;
     }
-       
+      
+    @Override
+    public boolean isAncestorOf( DvObject other ) {
+        while ( other != null ) {
+            if ( equals(other) ) return true;
+            other = other.getOwner();
+        }
+        return false;
+    }
 
 }
diff --git a/src/main/java/edu/harvard/iq/dataverse/DataversePage.java b/src/main/java/edu/harvard/iq/dataverse/DataversePage.java
index cfb2fcc252a..3d35e548347 100644
--- a/src/main/java/edu/harvard/iq/dataverse/DataversePage.java
+++ b/src/main/java/edu/harvard/iq/dataverse/DataversePage.java
@@ -58,12 +58,10 @@ public class DataversePage implements java.io.Serializable {
     private static final Logger logger = Logger.getLogger(DataversePage.class.getCanonicalName());
 
     public enum EditMode {
-
         CREATE, INFO, FEATURED
     }
     
     public enum LinkMode {
-
         SAVEDSEARCH,  LINKDATAVERSE
     }
 
@@ -111,8 +109,8 @@ public enum LinkMode {
     private LinkMode linkMode;
 
     private Long ownerId;
-    private DualListModel<DatasetFieldType> facets = new DualListModel<>(new ArrayList<DatasetFieldType>(), new ArrayList<DatasetFieldType>());
-    private DualListModel<Dataverse> featuredDataverses = new DualListModel<>(new ArrayList<Dataverse>(), new ArrayList<Dataverse>());
+    private DualListModel<DatasetFieldType> facets = new DualListModel<>(new ArrayList<>(), new ArrayList<>());
+    private DualListModel<Dataverse> featuredDataverses = new DualListModel<>(new ArrayList<>(), new ArrayList<>());
     private List<Dataverse> dataversesForLinking;
     private Long linkingDataverseId;
     private List<SelectItem> linkingDVSelectItems;
@@ -173,10 +171,8 @@ public void setDataverseSubjectControlledVocabularyValues(List<ControlledVocabul
     private void updateDataverseSubjectSelectItems() {
         DatasetFieldType subjectDatasetField = datasetFieldService.findByName(DatasetFieldConstant.subject);
         setDataverseSubjectControlledVocabularyValues(controlledVocabularyValueServiceBean.findByDatasetFieldTypeId(subjectDatasetField.getId()));
-
     }
     
-    
     public LinkMode getLinkMode() {
         return linkMode;
     }
@@ -185,7 +181,6 @@ public void setLinkMode(LinkMode linkMode) {
         this.linkMode = linkMode;
     }
     
-    
     public void setupLinkingPopup (String popupSetting){
         if (popupSetting.equals("link")){
             setLinkMode(LinkMode.LINKDATAVERSE);           
@@ -242,7 +237,6 @@ public void updateLinkableDataverses() {
     public void updateSelectedLinkingDV(ValueChangeEvent event) {
         linkingDataverseId = (Long) event.getNewValue();
     }
-//    private TreeNode treeWidgetRootNode = new DefaultTreeNode("Root", null);
 
     public Dataverse getDataverse() {
         return dataverse;
@@ -268,13 +262,6 @@ public void setOwnerId(Long ownerId) {
         this.ownerId = ownerId;
     }
 
-//    public TreeNode getTreeWidgetRootNode() {
-//        return treeWidgetRootNode;
-//    }
-//
-//    public void setTreeWidgetRootNode(TreeNode treeWidgetRootNode) {
-//        this.treeWidgetRootNode = treeWidgetRootNode;
-//    }
     public String init() {
         if (dataverse.getAlias() != null || dataverse.getId() != null || ownerId == null) {// view mode for a dataverse
             if (dataverse.getAlias() != null) {
diff --git a/src/main/java/edu/harvard/iq/dataverse/DataverseRequestServiceBean.java b/src/main/java/edu/harvard/iq/dataverse/DataverseRequestServiceBean.java
index 50274753a6b..e193b535412 100644
--- a/src/main/java/edu/harvard/iq/dataverse/DataverseRequestServiceBean.java
+++ b/src/main/java/edu/harvard/iq/dataverse/DataverseRequestServiceBean.java
@@ -6,7 +6,6 @@
 import javax.inject.Inject;
 import javax.inject.Named;
 import javax.servlet.http.HttpServletRequest;
-import javax.ws.rs.core.Context;
 
 /**
  * The service bean to go to when one needs the current {@link DataverseRequest}.
@@ -19,16 +18,16 @@ public class DataverseRequestServiceBean {
     @Inject
     DataverseSession dataverseSessionSvc;
     
-    @Context
-    HttpServletRequest httpRequest;
+    @Inject
+    private HttpServletRequest request;
     
-    private DataverseRequest dataverseRequest;
+   private DataverseRequest dataverseRequest;
     
     @PostConstruct
     protected void setup() {
-        dataverseRequest = new DataverseRequest(dataverseSessionSvc.getUser(), httpRequest);
+        dataverseRequest = new DataverseRequest(dataverseSessionSvc.getUser(), request);
     }
-
+    
     public DataverseRequest getDataverseRequest() {
         return dataverseRequest;
     }
diff --git a/src/main/java/edu/harvard/iq/dataverse/DataverseSession.java b/src/main/java/edu/harvard/iq/dataverse/DataverseSession.java
index 3770c54750a..54945a64cbd 100644
--- a/src/main/java/edu/harvard/iq/dataverse/DataverseSession.java
+++ b/src/main/java/edu/harvard/iq/dataverse/DataverseSession.java
@@ -4,7 +4,6 @@
 import edu.harvard.iq.dataverse.PermissionServiceBean.StaticPermissionQuery;
 import edu.harvard.iq.dataverse.actionlogging.ActionLogRecord;
 import edu.harvard.iq.dataverse.actionlogging.ActionLogServiceBean;
-import edu.harvard.iq.dataverse.authorization.users.AuthenticatedUser;
 import edu.harvard.iq.dataverse.authorization.users.GuestUser;
 import edu.harvard.iq.dataverse.authorization.users.User;
 import java.io.Serializable;
diff --git a/src/main/java/edu/harvard/iq/dataverse/DvObject.java b/src/main/java/edu/harvard/iq/dataverse/DvObject.java
index 89c27d3d4f4..47d4878f4cc 100644
--- a/src/main/java/edu/harvard/iq/dataverse/DvObject.java
+++ b/src/main/java/edu/harvard/iq/dataverse/DvObject.java
@@ -283,6 +283,13 @@ public Dataverse getDataverseContext() {
         return null;
     }    
     
+    /**
+     * 
+     * @param other 
+     * @return {@code true} iff {@code other} is {@code this} or below {@code this} in the containment hierarchy.
+     */
+    public abstract boolean isAncestorOf( DvObject other );
+    
     @OneToMany(mappedBy = "definitionPoint",cascade={ CascadeType.REMOVE, CascadeType.MERGE,CascadeType.PERSIST}, orphanRemoval=true)
     List<RoleAssignment> roleAssignments;
 }
diff --git a/src/main/java/edu/harvard/iq/dataverse/ManageGroupsPage.java b/src/main/java/edu/harvard/iq/dataverse/ManageGroupsPage.java
index 1452f802cf6..e5751216ddb 100644
--- a/src/main/java/edu/harvard/iq/dataverse/ManageGroupsPage.java
+++ b/src/main/java/edu/harvard/iq/dataverse/ManageGroupsPage.java
@@ -1,8 +1,3 @@
-/*
- * To change this license header, choose License Headers in Project Properties.
- * To change this template file, choose Tools | Templates
- * and open the template in the editor.
- */
 package edu.harvard.iq.dataverse;
 
 import edu.harvard.iq.dataverse.authorization.AuthenticationServiceBean;
@@ -12,7 +7,6 @@
 import edu.harvard.iq.dataverse.authorization.groups.GroupServiceBean;
 import edu.harvard.iq.dataverse.authorization.groups.impl.explicit.ExplicitGroup;
 import edu.harvard.iq.dataverse.authorization.groups.impl.explicit.ExplicitGroupServiceBean;
-import edu.harvard.iq.dataverse.authorization.users.AuthenticatedUser;
 import edu.harvard.iq.dataverse.authorization.users.User;
 import edu.harvard.iq.dataverse.engine.command.exception.CommandException;
 import edu.harvard.iq.dataverse.engine.command.impl.CreateExplicitGroupCommand;
@@ -23,7 +17,6 @@
 import java.util.ArrayList;
 import java.util.LinkedList;
 import java.util.List;
-import java.util.Set;
 import java.util.logging.Level;
 import java.util.logging.Logger;
 import java.util.regex.Pattern;
@@ -41,8 +34,6 @@
 import org.apache.commons.lang.StringUtils;
 
 /**
- * TODO: should we add groups to dataverse obj?
- * TODO: add support for logical groups.
  * @author michaelsuo
  */
 @ViewScoped
@@ -94,21 +85,15 @@ public String init() {
         if (editDv == null) {
             return permissionsWrapper.notFound();
         }
-
+        
         Boolean hasPermissions = permissionsWrapper.canIssueCommand(editDv, CreateExplicitGroupCommand.class);
         hasPermissions |= permissionsWrapper.canIssueCommand(editDv, DeleteExplicitGroupCommand.class);
         hasPermissions |= permissionsWrapper.canIssueCommand(editDv, UpdateExplicitGroupCommand.class);
         if (!hasPermissions) {
             return permissionsWrapper.notAuthorized();
         } 
-        explicitGroups = new LinkedList<>();
+        explicitGroups = new LinkedList<>(explicitGroupService.findByOwner(getDataverseId()));
 
-        List <ExplicitGroup> explicitGroupsForThisDataverse =
-                explicitGroupService.findByOwner(getDataverseId());
-
-        for (ExplicitGroup g : explicitGroupsForThisDataverse) {
-            getExplicitGroups().add(g);
-        }
         return null;
     }
 
@@ -160,7 +145,7 @@ public void deleteGroup() {
         }
     }
 
-    private List<RoleAssignee> selectedGroupRoleAssignees = new LinkedList<>();
+    private List<RoleAssignee> selectedGroupRoleAssignees = new ArrayList<>();
 
     public void setSelectedGroupRoleAssignees(List<RoleAssignee> newSelectedGroupRoleAssignees) {
         this.selectedGroupRoleAssignees = newSelectedGroupRoleAssignees;
@@ -184,26 +169,19 @@ public void viewSelectedGroup(ExplicitGroup selectedGroup) {
         this.selectedGroup = selectedGroup;
 
         // initialize member list for autocomplete interface
-        setSelectedGroupAddRoleAssignees(new LinkedList<RoleAssignee>());
+        setSelectedGroupAddRoleAssignees(new LinkedList<>());
         setSelectedGroupRoleAssignees(getExplicitGroupMembers(selectedGroup));
     }
 
     /**
      * Return the set of all role assignees for an explicit group.
      * Does not traverse subgroups.
-     * TODO right now only checks for authenticated users and explicit groups.
      * @param eg The explicit group to check.
      * @return The set of role assignees belonging to explicit group.
      */
     public List<RoleAssignee> getExplicitGroupMembers(ExplicitGroup eg) {
-        if (eg != null) {
-            List<RoleAssignee> ras = new LinkedList<>();
-            ras.addAll(eg.getContainedAuthenticatedUsers());
-            ras.addAll(eg.getContainedExplicitGroups());
-            return ras;
-        } else {
-            return null;
-        }
+        return (eg != null) ? 
+                new ArrayList(eg.getDirectMembers()) : null;
     }
 
     /**
@@ -223,8 +201,15 @@ public String getRoleAssigneeTypeString(RoleAssignee ra) {
     }
 
     public String getMembershipString(ExplicitGroup eg) {
-        long userCount = getGroupAuthenticatedUserCount(eg);
-        long groupCount = getGroupGroupCount(eg);
+        long userCount = 0;
+        long groupCount = 0;
+        for ( RoleAssignee ra : eg.getDirectMembers() ) {
+            if ( ra instanceof User ) {
+                userCount++;
+            } else {
+                groupCount++;
+            }
+        }
 
         if (userCount == 0 && groupCount == 0) {
             return "No members";
@@ -246,28 +231,6 @@ public String getMembershipString(ExplicitGroup eg) {
         return memberString;
     }
 
-    /**
-     * Returns the number of authenticated users in an {@code ExplicitGroup}.
-     * Does not traverse subgroups.
-     * @param group The {@code ExplicitGroup} to get the user count for
-     * @return User count as long
-     */
-    public long getGroupAuthenticatedUserCount(ExplicitGroup eg) {
-        Set<AuthenticatedUser> aus = eg.getContainedAuthenticatedUsers();
-        return aus.size();
-    }
-
-    /**
-     * Returns the number of explicit groups in an {@code ExplicitGroup}.
-     * Does not traverse subgroups.
-     * @param group The {@code ExplicitGroup} to get the group count for
-     * @return Group count as long
-     */
-    public long getGroupGroupCount(ExplicitGroup eg) {
-        Set<ExplicitGroup> egs = eg.getContainedExplicitGroups();
-        return egs.size();
-    }
-
     public void removeMemberFromSelectedGroup(RoleAssignee ra) {
         selectedGroup.remove(ra);
     }
@@ -308,7 +271,7 @@ public void initExplicitGroupDialog(ActionEvent ae) {
         setExplicitGroupName("");
         setExplicitGroupIdentifier("");
         setNewExplicitGroupDescription("");
-        setNewExplicitGroupRoleAssignees(new LinkedList<RoleAssignee>());
+        setNewExplicitGroupRoleAssignees(new LinkedList<>());
         FacesContext context = FacesContext.getCurrentInstance();
         setSelectedGroupRoleAssignees(null);
     }
diff --git a/src/main/java/edu/harvard/iq/dataverse/PermissionServiceBean.java b/src/main/java/edu/harvard/iq/dataverse/PermissionServiceBean.java
index 82019c3db85..ef6ab430c8d 100644
--- a/src/main/java/edu/harvard/iq/dataverse/PermissionServiceBean.java
+++ b/src/main/java/edu/harvard/iq/dataverse/PermissionServiceBean.java
@@ -1,6 +1,5 @@
 package edu.harvard.iq.dataverse;
 
-import edu.harvard.iq.dataverse.api.datadeposit.SwordAuth;
 import edu.harvard.iq.dataverse.authorization.AuthenticationServiceBean;
 import edu.harvard.iq.dataverse.authorization.DataverseRole;
 import edu.harvard.iq.dataverse.authorization.providers.builtin.BuiltinUserServiceBean;
@@ -10,7 +9,6 @@
 import edu.harvard.iq.dataverse.authorization.groups.Group;
 import edu.harvard.iq.dataverse.authorization.groups.GroupServiceBean;
 import edu.harvard.iq.dataverse.authorization.groups.GroupUtil;
-import edu.harvard.iq.dataverse.authorization.groups.impl.builtin.AuthenticatedUsers;
 import edu.harvard.iq.dataverse.authorization.users.AuthenticatedUser;
 import edu.harvard.iq.dataverse.authorization.users.User;
 import edu.harvard.iq.dataverse.engine.command.Command;
@@ -28,7 +26,10 @@
 import javax.persistence.PersistenceContext;
 import static edu.harvard.iq.dataverse.engine.command.CommandHelper.CH;
 import edu.harvard.iq.dataverse.engine.command.DataverseRequest;
+import java.util.Arrays;
 import java.util.LinkedList;
+import java.util.logging.Level;
+import java.util.stream.Collectors;
 import javax.persistence.Query;
 
 /**
@@ -45,15 +46,10 @@ public class PermissionServiceBean {
 
     private static final Logger logger = Logger.getLogger(PermissionServiceBean.class.getName());
     
-    private static final EnumSet<Permission> PERMISSIONS_FOR_AUTHENTICATED_USERS_ONLY = EnumSet.noneOf( Permission.class );
-    
-    static {
-        for ( Permission p : Permission.values() ) {
-            if ( p.requiresAuthenticatedUser() ) {
-                PERMISSIONS_FOR_AUTHENTICATED_USERS_ONLY.add(p);
-            }
-        }
-    }
+    private static final Set<Permission> PERMISSIONS_FOR_AUTHENTICATED_USERS_ONLY = 
+           EnumSet.copyOf(Arrays.asList(Permission.values()).stream()
+                    .filter( Permission::requiresAuthenticatedUser )
+                    .collect( Collectors.toList() ));
     
     @EJB
     BuiltinUserServiceBean userService;
@@ -210,9 +206,11 @@ public Set<Permission> permissionsFor( DataverseRequest req, DvObject dvo ) {
         // Add permissions specifically given to the user
         permissions.addAll( permissionsForSingleRoleAssignee(req.getUser(),dvo) );
         Set<Group> groups = groupService.groupsFor(req,dvo);
+        
         // Add permissions gained from groups
         for ( Group g : groups ) {
-            permissions.addAll( permissionsForSingleRoleAssignee(g,dvo) );
+            final Set<Permission> groupPremissions = permissionsForSingleRoleAssignee(g,dvo);
+            permissions.addAll(groupPremissions);
         }
         
         if ( ! req.getUser().isAuthenticated() ) {
@@ -253,14 +251,16 @@ public Set<Permission> permissionsFor(RoleAssignee ra, DvObject dvo) {
     
     private Set<Permission> permissionsForSingleRoleAssignee(RoleAssignee ra, DvObject d) {
         // super user check
-        // @todo for 4.0, we are allowing superusers all permissions
+        // for 4.0, we are allowing superusers all permissions
         // for secure data, we may need to restrict some of the permissions
         if (ra instanceof AuthenticatedUser && ((AuthenticatedUser) ra).isSuperuser()) {
             return EnumSet.allOf(Permission.class);
         }
-
+        
+        // Start with no permissions, build from there.
         Set<Permission> retVal = EnumSet.noneOf(Permission.class);
 
+        // File special case.
         if (d instanceof DataFile) {
             // unrestricted files that are part of a release dataset 
             // automatically get download permission for everybody:
@@ -274,6 +274,7 @@ private Set<Permission> permissionsForSingleRoleAssignee(RoleAssignee ra, DvObje
                         for (FileMetadata fm : df.getOwner().getReleasedVersion().getFileMetadatas()) {
                             if (df.equals(fm.getDataFile())) {
                                 retVal.add(Permission.DownloadFile);
+                                break;
                             }
                         }
                     }
@@ -281,10 +282,14 @@ private Set<Permission> permissionsForSingleRoleAssignee(RoleAssignee ra, DvObje
             }
         }
         
-        for (RoleAssignment asmnt : assignmentsFor(ra, d)) {
-            retVal.addAll(asmnt.getRole().permissions());
-        }
+        // Direct assignments to ra on d
+        assignmentsFor(ra, d).forEach( 
+                asmnt -> retVal.addAll(asmnt.getRole().permissions())
+        );
         
+        // Recurse up the group containment hierarchy.
+        groupService.groupsFor(ra, d).forEach(
+                grp -> retVal.addAll(permissionsForSingleRoleAssignee(grp, d)));
         return retVal;
     }
 
@@ -386,7 +391,7 @@ public List<Dataverse> getDataversesUserHasPermissionOn(AuthenticatedUser user,
          * query?
          */
         String query = "SELECT id FROM dvobject WHERE dtype = 'Dataverse' and id in (select definitionpoint_id from roleassignment where assigneeidentifier in (" + identifiers + "));";
-        logger.fine("query: " + query);
+        logger.log(Level.FINE, "query: {0}", query);
         Query nativeQuery = em.createNativeQuery(query);
         List<Integer> dataverseIdsToCheck = nativeQuery.getResultList();
         List<Dataverse> dataversesUserHasPermissionOn = new LinkedList<>();
diff --git a/src/main/java/edu/harvard/iq/dataverse/PermissionsWrapper.java b/src/main/java/edu/harvard/iq/dataverse/PermissionsWrapper.java
index 9a60f71d0df..3261cf1287c 100644
--- a/src/main/java/edu/harvard/iq/dataverse/PermissionsWrapper.java
+++ b/src/main/java/edu/harvard/iq/dataverse/PermissionsWrapper.java
@@ -8,6 +8,7 @@
 import edu.harvard.iq.dataverse.authorization.Permission;
 import edu.harvard.iq.dataverse.authorization.users.User;
 import edu.harvard.iq.dataverse.engine.command.Command;
+import edu.harvard.iq.dataverse.engine.command.DataverseRequest;
 import edu.harvard.iq.dataverse.engine.command.impl.*;
 import java.util.HashMap;
 import java.util.Map;
@@ -42,7 +43,9 @@ public class PermissionsWrapper implements java.io.Serializable {
     /**
      * Check if the current Dataset can Issue Commands
      *
-     * @param commandName
+     * @param dvo Target dataverse object.
+     * @param command The command to execute
+     * @return {@code true} if the user can issue the command on the object.
      */
     public boolean canIssueCommand(DvObject dvo, Class<? extends Command> command) {
         if ((dvo==null) || (dvo.getId()==null)){
@@ -118,7 +121,7 @@ public boolean canManageDataversePermissions(User u, Dataverse dv) {
         if (u==null){            
             return false;
         }
-        return permissionService.userOn(u, dv).has(Permission.ManageDataversePermissions);
+        return permissionService.requestOn(dvRequestService.getDataverseRequest(), dv).has(Permission.ManageDataversePermissions);
     }
     
     public boolean canManageDatasetPermissions(User u, Dataset ds) {
@@ -128,15 +131,15 @@ public boolean canManageDatasetPermissions(User u, Dataset ds) {
         if (u==null){            
             return false;
         }
-        return permissionService.userOn(u, ds).has(Permission.ManageDatasetPermissions);
+        return permissionService.requestOn(dvRequestService.getDataverseRequest(), ds).has(Permission.ManageDatasetPermissions);
     }
 
-    public boolean canViewUnpublishedDataset(User user, Dataset dataset) {
-        return doesSessionUserHaveDataSetPermission(user, dataset, Permission.ViewUnpublishedDataset);
+    public boolean canViewUnpublishedDataset(DataverseRequest dr, Dataset dataset) {
+        return doesSessionUserHaveDataSetPermission(dr, dataset, Permission.ViewUnpublishedDataset);
     }
     
-    public boolean canUpdateDataset(User user, Dataset dataset) {
-        return doesSessionUserHaveDataSetPermission(user, dataset, Permission.EditDataset);
+    public boolean canUpdateDataset(DataverseRequest dr, Dataset dataset) {
+        return doesSessionUserHaveDataSetPermission(dr, dataset, Permission.EditDataset);
     }
     
             
@@ -147,12 +150,12 @@ public boolean canUpdateDataset(User user, Dataset dataset) {
      * 
      * Check Dataset related permissions
      * 
-     * @param user
+     * @param req
      * @param dataset
      * @param permissionToCheck
      * @return 
      */
-    public boolean doesSessionUserHaveDataSetPermission(User user, Dataset dataset, Permission permissionToCheck){
+    public boolean doesSessionUserHaveDataSetPermission(DataverseRequest req, Dataset dataset, Permission permissionToCheck){
         if (permissionToCheck == null){
             return false;
         }
@@ -167,8 +170,7 @@ public boolean doesSessionUserHaveDataSetPermission(User user, Dataset dataset,
         }
         
         // Check the permission
-        //
-        boolean hasPermission = this.permissionService.userOn(user, dataset).has(permissionToCheck);
+        boolean hasPermission = this.permissionService.requestOn(req, dataset).has(permissionToCheck);
 
         // Save the permission
         this.datasetPermissionMap.put(permName, hasPermission);
@@ -196,17 +198,16 @@ public boolean hasDownloadFilePermission(DvObject dvo){
 
         // Check permissions
         //
-        if (this.permissionService.on(dvo).has(Permission.DownloadFile)){
+        if ( permissionService.on(dvo).has(Permission.DownloadFile) ){
 
             // Yes, has permission, store result
-            //
-            this.fileDownloadPermissionMap.put(dvo.getId(), true);
+            fileDownloadPermissionMap.put(dvo.getId(), true);
             return true;
-        }else {
+            
+        } else {
         
             // No permission, store result
-            //
-            this.fileDownloadPermissionMap.put(dvo.getId(), false);
+            fileDownloadPermissionMap.put(dvo.getId(), false);
             return false;
         }
     }
diff --git a/src/main/java/edu/harvard/iq/dataverse/RoleAssigneeServiceBean.java b/src/main/java/edu/harvard/iq/dataverse/RoleAssigneeServiceBean.java
index 76601774000..7c413d98e68 100644
--- a/src/main/java/edu/harvard/iq/dataverse/RoleAssigneeServiceBean.java
+++ b/src/main/java/edu/harvard/iq/dataverse/RoleAssigneeServiceBean.java
@@ -11,6 +11,8 @@
 import edu.harvard.iq.dataverse.authorization.groups.impl.explicit.ExplicitGroupServiceBean;
 import edu.harvard.iq.dataverse.authorization.users.AuthenticatedUser;
 import edu.harvard.iq.dataverse.authorization.users.GuestUser;
+import edu.harvard.iq.dataverse.engine.command.DataverseRequest;
+import edu.harvard.iq.dataverse.mydata.MyDataFilterParams;
 import edu.harvard.iq.dataverse.privateurl.PrivateUrlUtil;
 import java.util.ArrayList;
 import java.util.List;
@@ -18,6 +20,7 @@
 import java.util.Set;
 import java.util.TreeMap;
 import java.util.logging.Logger;
+import java.util.stream.Collectors;
 import javax.annotation.PostConstruct;
 import javax.ejb.EJB;
 import javax.ejb.Stateless;
@@ -51,10 +54,10 @@ public class RoleAssigneeServiceBean {
     @EJB
     DataverseRoleServiceBean dataverseRoleService;
 
-    Map<String, RoleAssignee> predefinedRoleAssignees = new TreeMap<>();
+    protected Map<String, RoleAssignee> predefinedRoleAssignees = new TreeMap<>();
 
     @PostConstruct
-    void setup() {
+    protected void setup() {
         GuestUser gu = GuestUser.get();
         predefinedRoleAssignees.put(gu.getIdentifier(), gu);
         predefinedRoleAssignees.put(AuthenticatedUsers.get().getIdentifier(), AuthenticatedUsers.get());
@@ -126,15 +129,21 @@ private String getRoleIdListClause(List<Long> roleIdList) {
         return " AND r.role_id IN (" + StringUtils.join(outputList, ",") + ")";
     }
 
-    public List<DataverseRole> getAssigneeDataverseRoleFor(AuthenticatedUser au) {
-        String roleAssigneeIdentifier = "@" + au.getUserIdentifier();
-        if (roleAssigneeIdentifier == null) {
+    public List<DataverseRole> getAssigneeDataverseRoleFor(DataverseRequest dataverseRequest) {
+        
+        if (dataverseRequest == null){
+            throw new NullPointerException("dataverseRequest cannot be null!");
+        }
+        AuthenticatedUser au = dataverseRequest.getAuthenticatedUser();
+        if (au.getUserIdentifier() == null){
             return null;
         }
+        String roleAssigneeIdentifier = "@" + au.getUserIdentifier();
+
         List<DataverseRole> retList = new ArrayList();
         roleAssigneeIdentifier = roleAssigneeIdentifier.replaceAll("\\s", "");   // remove spaces from string
-        List<String> userGroups = getUserExplicitGroups(roleAssigneeIdentifier.replace("@", ""));
-        List<String> userRunTimeGroups = getUserRuntimeGroups(au);
+        List<String> userGroups = getUserExplicitGroups(au);
+        List<String> userRunTimeGroups = getUserRuntimeGroups(dataverseRequest);
         String identifierClause = " WHERE r.assigneeIdentifier= '" + roleAssigneeIdentifier + "'";
         if (userGroups != null || userRunTimeGroups != null) {
 
@@ -153,16 +162,25 @@ public List<DataverseRole> getAssigneeDataverseRoleFor(AuthenticatedUser au) {
         return retList;
     }
 
-    public List<Object[]> getAssigneeAndRoleIdListFor(AuthenticatedUser au, List<Long> roleIdList) {
-
-        String roleAssigneeIdentifier = "@" + au.getUserIdentifier();
-
-        if (roleAssigneeIdentifier == null) {
+    public List<Object[]> getAssigneeAndRoleIdListFor(MyDataFilterParams filterParams) {
+         
+        if (filterParams == null){
+            throw new NullPointerException("Cannot be null! filterParams must be an instance of MyDataFilterParams");
+        }
+        
+        AuthenticatedUser au = filterParams.getAuthenticatedUser();
+        List<Long> roleIdList = filterParams.getRoleIds();
+                        //filterParams.getAuthenticatedUser()
+                //                       , this.filterParams.getRoleIds());
+        
+        if (au.getUserIdentifier() == null) {
             return null;
         }
+        String roleAssigneeIdentifier = "@" + au.getUserIdentifier();
+        
         roleAssigneeIdentifier = roleAssigneeIdentifier.replaceAll("\\s", "");   // remove spaces from string
-        List<String> userExplicitGroups = getUserExplicitGroups(roleAssigneeIdentifier.replace("@", ""));
-        List<String> userRunTimeGroups = getUserRuntimeGroups(au);
+        List<String> userExplicitGroups = getUserExplicitGroups(au);
+        List<String> userRunTimeGroups = getUserRuntimeGroups(filterParams.getDataverseRequest());
         String identifierClause = " WHERE r.assigneeIdentifier= '" + roleAssigneeIdentifier + "'";
         if (userExplicitGroups != null || userRunTimeGroups != null) {
             identifierClause = getGroupIdentifierClause(roleAssigneeIdentifier, userExplicitGroups, userRunTimeGroups);
@@ -179,14 +197,18 @@ public List<Object[]> getAssigneeAndRoleIdListFor(AuthenticatedUser au, List<Lon
 
     }
 
-    public List<Long> getRoleIdListForGivenAssigneeDvObject(AuthenticatedUser au, List<Long> roleIdList, Long defPointId) {
-        String roleAssigneeIdentifier = "@" + au.getUserIdentifier();
-        if (roleAssigneeIdentifier == null) {
+    public List<Long> getRoleIdListForGivenAssigneeDvObject(DataverseRequest dataverseRequest, List<Long> roleIdList, Long defPointId) {
+        if (dataverseRequest == null){
+            throw new NullPointerException("dataverseRequest cannot be null!");
+        }
+        AuthenticatedUser au = dataverseRequest.getAuthenticatedUser();
+        if (au.getUserIdentifier() == null){
             return null;
         }
+        String roleAssigneeIdentifier = "@" + au.getUserIdentifier();
         roleAssigneeIdentifier = roleAssigneeIdentifier.replaceAll("\\s", "");   // remove spaces from string
-        List<String> userGroups = getUserExplicitGroups(roleAssigneeIdentifier.replace("@", ""));
-        List<String> userRunTimeGroups = getUserRuntimeGroups(au);
+        List<String> userGroups = getUserExplicitGroups(au);
+        List<String> userRunTimeGroups = getUserRuntimeGroups(dataverseRequest);
         String identifierClause = " WHERE r.assigneeIdentifier= '" + roleAssigneeIdentifier + "'";
         if (userGroups != null || userRunTimeGroups != null) {
             identifierClause = getGroupIdentifierClause(roleAssigneeIdentifier, userGroups, userRunTimeGroups);
@@ -245,15 +267,19 @@ private String getGroupIdentifierClause(String roleAssigneeIdentifier, List<Stri
 
     }
 
-    public List<Object[]> getRoleIdsFor(AuthenticatedUser au, List<Long> dvObjectIdList) {
-        String roleAssigneeIdentifier = "@" + au.getUserIdentifier();
-        if (roleAssigneeIdentifier == null) {
+    public List<Object[]> getRoleIdsFor(DataverseRequest dataverseRequest, List<Long> dvObjectIdList) {
+        if (dataverseRequest == null){
+            throw new NullPointerException("dataverseRequest cannot be null!");
+        }
+        AuthenticatedUser au = dataverseRequest.getAuthenticatedUser();
+        if (au.getUserIdentifier() == null){
             return null;
         }
+        String roleAssigneeIdentifier = "@" + au.getUserIdentifier();
 
         roleAssigneeIdentifier = roleAssigneeIdentifier.replaceAll("\\s", "");   // remove spaces from string
-        List<String> userGroups = getUserExplicitGroups(roleAssigneeIdentifier.replace("@", ""));
-        List<String> userRunTimeGroups = getUserRuntimeGroups(au);
+        List<String> userGroups = getUserExplicitGroups(au);
+        List<String> userRunTimeGroups = getUserRuntimeGroups(dataverseRequest);
         String identifierClause = " WHERE r.assigneeIdentifier= '" + roleAssigneeIdentifier + "'";
         if (userGroups != null || userRunTimeGroups != null) {
             identifierClause = getGroupIdentifierClause(roleAssigneeIdentifier, userGroups, userRunTimeGroups);
@@ -289,36 +315,35 @@ private String getDvObjectIdListClause(List<Long> dvObjectIdList) {
     }
 
     /**
-     * @todo Support groups within groups:
-     * https://github.com/IQSS/dataverse/issues/3056
+     * @param ra
+     * @todo Support groups within groups: https://github.com/IQSS/dataverse/issues/3056
+     * @return List of aliases of all explicit groups {@code ra} is in.
      */
-    public List<String> getUserExplicitGroups(String roleAssigneeIdentifier) {
-
-        String qstr = "select  groupalias from explicitgroup";
-        qstr += " where id in ";
-        qstr += " (select explicitgroup_id from explicitgroup_authenticateduser where containedauthenticatedusers_id = ";
-        qstr += " (select id from authenticateduser where useridentifier ='" + roleAssigneeIdentifier + "'";
-        qstr += "));";
-        //msg("qstr: " + qstr);
-
-        return em.createNativeQuery(qstr)
-                .getResultList();
+    public List<String> getUserExplicitGroups(RoleAssignee ra) {
+        return explicitGroupSvc.findGroups(ra).stream()
+                               .map( g -> g.getAlias())
+                               .collect(Collectors.toList());
     }
 
-    private List<String> getUserRuntimeGroups(AuthenticatedUser au) {
+    private List<String> getUserRuntimeGroups(DataverseRequest dataverseRequest) {
         List<String> retVal = new ArrayList();
 
-        Set<Group> groups = groupSvc.groupsFor(au, null);
-        StringBuilder sb = new StringBuilder();
+        //Set<Group> groups = groupSvc.groupsFor(dataverseRequest, null);
+        Set<Group> groups = groupSvc.collectAncestors(groupSvc.groupsFor(dataverseRequest));
         for (Group group : groups) {
             logger.fine("found group " + group.getIdentifier() + " with alias " + group.getAlias());
-            if (group.getGroupProvider().getGroupProviderAlias().equals("shib") || group.getGroupProvider().getGroupProviderAlias().equals("ip")) {
+           // if (group.getGroupProvider().getGroupProviderAlias().equals("shib") || group.getGroupProvider().getGroupProviderAlias().equals("ip")) {
                 String groupAlias = group.getAlias();
                 if (groupAlias != null && !groupAlias.isEmpty()) {
-                    retVal.add('&' + groupAlias);
+                    if( group instanceof ExplicitGroup){
+                        retVal.add("&explicit/" + groupAlias);
+                    } else{
+                        retVal.add('&' + groupAlias);
+                    }
                 }
-            }
+            //}
         }
+        logger.fine("retVal: " + retVal);
         return retVal;
     }
 
diff --git a/src/main/java/edu/harvard/iq/dataverse/api/AbstractApiBean.java b/src/main/java/edu/harvard/iq/dataverse/api/AbstractApiBean.java
index a796846cb95..6068a2c6e1e 100644
--- a/src/main/java/edu/harvard/iq/dataverse/api/AbstractApiBean.java
+++ b/src/main/java/edu/harvard/iq/dataverse/api/AbstractApiBean.java
@@ -187,7 +187,7 @@ String getWrappedMessageWhenJson() {
 	protected EntityManager em;
     
     @Context
-    HttpServletRequest httpRequest;
+    protected HttpServletRequest httpRequest;
 	
     /**
      * For pretty printing (indenting) of JSON output.
diff --git a/src/main/java/edu/harvard/iq/dataverse/api/Access.java b/src/main/java/edu/harvard/iq/dataverse/api/Access.java
index 13246042cc8..11746a19c04 100644
--- a/src/main/java/edu/harvard/iq/dataverse/api/Access.java
+++ b/src/main/java/edu/harvard/iq/dataverse/api/Access.java
@@ -10,11 +10,11 @@
 import edu.harvard.iq.dataverse.DataFile;
 import edu.harvard.iq.dataverse.FileMetadata;
 import edu.harvard.iq.dataverse.DataFileServiceBean;
-import edu.harvard.iq.dataverse.Dataset;
 import edu.harvard.iq.dataverse.DatasetVersion;
 import edu.harvard.iq.dataverse.DatasetVersionServiceBean;
 import edu.harvard.iq.dataverse.DatasetServiceBean;
 import edu.harvard.iq.dataverse.Dataverse;
+import edu.harvard.iq.dataverse.DataverseRequestServiceBean;
 import edu.harvard.iq.dataverse.DataverseServiceBean;
 import edu.harvard.iq.dataverse.DataverseSession;
 import edu.harvard.iq.dataverse.DataverseTheme;
@@ -36,7 +36,6 @@
 import edu.harvard.iq.dataverse.util.SystemConfig;
 import edu.harvard.iq.dataverse.worldmapauth.WorldMapTokenServiceBean;
 
-import java.util.List;
 import java.util.logging.Logger;
 import javax.ejb.EJB;
 import java.io.InputStream;
@@ -47,6 +46,7 @@
 import java.io.OutputStream;
 import java.util.ArrayList;
 import java.util.Properties;
+import java.util.logging.Level;
 import javax.inject.Inject;
 
 import javax.ws.rs.GET;
@@ -111,7 +111,10 @@ public class Access extends AbstractApiBean {
     DataverseSession session;
     @EJB
     WorldMapTokenServiceBean worldMapTokenServiceBean;
-
+    @Inject
+    DataverseRequestServiceBean dvRequestService;
+    
+    
     private static final String API_KEY_HEADER = "X-Dataverse-key";    
 
     //@EJB
@@ -938,7 +941,6 @@ private boolean isAccessAuthorized(DataFile df, String apiToken) {
             }
         }
         
-        
         if (!restricted) {
             // And if they are not published, they can still be downloaded, if the user
             // has the permission to view unpublished versions! (this case will 
@@ -992,7 +994,7 @@ private boolean isAccessAuthorized(DataFile df, String apiToken) {
                 logger.fine("calling apiTokenUser = findUserOrDie()...");
                 apiTokenUser = findUserOrDie();
             } catch (WrappedResponse wr) {
-                logger.fine("Message from findUserOrDie(): " + wr.getMessage());
+                logger.log(Level.FINE, "Message from findUserOrDie(): {0}", wr.getMessage());
             }
             
             if (apiTokenUser == null) {
@@ -1008,22 +1010,31 @@ private boolean isAccessAuthorized(DataFile df, String apiToken) {
             // If the file is not published, they can still download the file, if the user
             // has the permission to view unpublished versions:
             
-            if (permissionService.userOn(user, df.getOwner()).has(Permission.ViewUnpublishedDataset)) {
-                if (user != null) {
+            if ( user != null ) {
+                // used in JSF context
+                if (permissionService.requestOn(dvRequestService.getDataverseRequest(), df.getOwner()).has(Permission.ViewUnpublishedDataset)) {
                     // it's not unthinkable, that a null user (i.e., guest user) could be given
                     // the ViewUnpublished permission!
-                    logger.fine("Session-based auth: user " + user.getIdentifier() + " has access rights on the non-restricted, unpublished datafile.");
+                    logger.log(Level.FINE, "Session-based auth: user {0} has access rights on the non-restricted, unpublished datafile.", user.getIdentifier());
+                    return true;
                 }
-                return true;
             }
             
             if (apiTokenUser != null) {
-                if (permissionService.userOn(apiTokenUser, df.getOwner()).has(Permission.ViewUnpublishedDataset)) {
-                    logger.fine("Session-based auth: user " + apiTokenUser.getIdentifier() + " has access rights on the non-restricted, unpublished datafile.");
+                // used in an API context
+                if (permissionService.requestOn( createDataverseRequest(apiTokenUser), df.getOwner()).has(Permission.ViewUnpublishedDataset)) {
+                    logger.log(Level.FINE, "Session-based auth: user {0} has access rights on the non-restricted, unpublished datafile.", apiTokenUser.getIdentifier());
                     return true;
                 }
             }
             
+            // last option - guest user in either contexts
+            // Guset user is impled by the code above.
+            if ( permissionService.requestOn(dvRequestService.getDataverseRequest(), df.getOwner()).has(Permission.ViewUnpublishedDataset) ) {
+                return true;
+            }
+                    
+            
             // We don't want to return false just yet. 
             // If all else fails, we'll want to use the special WorldMapAuth 
             // token authentication before we give up. 
@@ -1040,7 +1051,7 @@ private boolean isAccessAuthorized(DataFile df, String apiToken) {
             // User from the Session object, just like in the code fragment 
             // above. That's why it's not passed along as an argument.
                 hasAccessToRestrictedBySession = true; 
-            } else if (apiTokenUser != null && permissionService.userOn(apiTokenUser, df).has(Permission.DownloadFile)) {
+            } else if (apiTokenUser != null && permissionService.requestOn(createDataverseRequest(apiTokenUser), df).has(Permission.DownloadFile)) {
                 hasAccessToRestrictedByToken = true; 
             }
             
@@ -1048,33 +1059,34 @@ private boolean isAccessAuthorized(DataFile df, String apiToken) {
                 if (published) {
                     if (hasAccessToRestrictedBySession) {
                         if (user != null) {
-                            logger.fine("Session-based auth: user " + user.getIdentifier() + " is granted access to the restricted, published datafile.");
+                            logger.log(Level.FINE, "Session-based auth: user {0} is granted access to the restricted, published datafile.", user.getIdentifier());
                         } else {
                             logger.fine("Session-based auth: guest user is granted access to the restricted, published datafile.");
                         }
                     } else {
-                        logger.fine("Token-based auth: user " + apiTokenUser.getIdentifier() + " is granted access to the restricted, published datafile.");
+                        logger.log(Level.FINE, "Token-based auth: user {0} is granted access to the restricted, published datafile.", apiTokenUser.getIdentifier());
                     }
                     return true;
                 } else {
                     // if the file is NOT published, we will let them download the 
                     // file ONLY if they also have the permission to view 
-                    // unpublished verions:
+                    // unpublished versions:
                     // Note that the code below does not allow a case where it is the
                     // session user that has the permission on the file, and the API token 
                     // user with the ViewUnpublished permission, or vice versa!
                     if (hasAccessToRestrictedBySession) {
                         if (permissionService.on(df.getOwner()).has(Permission.ViewUnpublishedDataset)) {
                             if (user != null) {
-                                logger.fine("Session-based auth: user " + user.getIdentifier() + " is granted access to the restricted, unpublished datafile.");
+                                logger.log(Level.FINE, "Session-based auth: user {0} is granted access to the restricted, unpublished datafile.", user.getIdentifier());
                             } else {
                                 logger.fine("Session-based auth: guest user is granted access to the restricted, unpublished datafile.");
                             }
                             return true;
                         } 
                     } else {
-                        if (apiTokenUser != null && permissionService.userOn(apiTokenUser, df.getOwner()).has(Permission.ViewUnpublishedDataset)) {
-                            logger.fine("Token-based auth: user " + apiTokenUser.getIdentifier() + " is granted access to the restricted, unpublished datafile.");
+                        if (apiTokenUser != null && permissionService.requestOn(createDataverseRequest(apiTokenUser), df.getOwner()).has(Permission.ViewUnpublishedDataset)) {
+                            logger.log(Level.FINE, "Token-based auth: user {0} is granted access to the restricted, unpublished datafile.", apiTokenUser.getIdentifier());
+                            return true;
                         }
                     }
                 }
@@ -1111,7 +1123,7 @@ private boolean isAccessAuthorized(DataFile df, String apiToken) {
                 logger.fine("calling user = findUserOrDie()...");
                 user = findUserOrDie();
             } catch (WrappedResponse wr) {
-                logger.fine("Message from findUserOrDie(): " + wr.getMessage());
+                logger.log(Level.FINE, "Message from findUserOrDie(): {0}", wr.getMessage());
             }
             
             if (user == null) {
@@ -1119,34 +1131,34 @@ private boolean isAccessAuthorized(DataFile df, String apiToken) {
                 return false;
             } 
             
-            if (permissionService.userOn(user, df).has(Permission.DownloadFile)) { 
+        if (permissionService.requestOn(createDataverseRequest(user), df).has(Permission.DownloadFile)) { 
                 if (published) {
-                    logger.fine("API token-based auth: User " + user.getIdentifier() + " has rights to access the datafile.");
+                    logger.log(Level.FINE, "API token-based auth: User {0} has rights to access the datafile.", user.getIdentifier());
                     return true; 
                 } else {
                     // if the file is NOT published, we will let them download the 
                     // file ONLY if they also have the permission to view 
-                    // unpublished verions:
-                    if (permissionService.userOn(user, df.getOwner()).has(Permission.ViewUnpublishedDataset)) {
-                        logger.fine("API token-based auth: User " + user.getIdentifier() + " has rights to access the (unpublished) datafile.");
+                    // unpublished versions:
+                    if (permissionService.requestOn(createDataverseRequest(user), df.getOwner()).has(Permission.ViewUnpublishedDataset)) {
+                        logger.log(Level.FINE, "API token-based auth: User {0} has rights to access the (unpublished) datafile.", user.getIdentifier());
                         return true;
                     } else {
-                        logger.fine("API token-based auth: User " + user.getIdentifier() + " is not authorized to access the (unpublished) datafile.");
+                        logger.log(Level.FINE, "API token-based auth: User {0} is not authorized to access the (unpublished) datafile.", user.getIdentifier());
                     }
                 }
             } else {
-                logger.fine("API token-based auth: User " + user.getIdentifier() + " is not authorized to access the datafile.");
+                logger.log(Level.FINE, "API token-based auth: User {0} is not authorized to access the datafile.", user.getIdentifier());
             }
             
             return false;
         } 
         
         if (user != null) {
-            logger.fine("Session-based auth: user " + user.getIdentifier() + " has NO access rights on the requested datafile.");
+            logger.log(Level.FINE, "Session-based auth: user {0} has NO access rights on the requested datafile.", user.getIdentifier());
         } 
         
         if (apiTokenUser != null) {
-            logger.fine("Token-based auth: user " + apiTokenUser.getIdentifier() + " has NO access rights on the requested datafile.");
+            logger.log(Level.FINE, "Token-based auth: user {0} has NO access rights on the requested datafile.", apiTokenUser.getIdentifier());
         } 
         
         if (user == null && apiTokenUser == null) {
@@ -1154,7 +1166,6 @@ private boolean isAccessAuthorized(DataFile df, String apiToken) {
         }
         
         return false; 
-    }
-    
+    }   
             
 }
\ No newline at end of file
diff --git a/src/main/java/edu/harvard/iq/dataverse/api/Admin.java b/src/main/java/edu/harvard/iq/dataverse/api/Admin.java
index 5ef20c36158..ac1128d3aeb 100644
--- a/src/main/java/edu/harvard/iq/dataverse/api/Admin.java
+++ b/src/main/java/edu/harvard/iq/dataverse/api/Admin.java
@@ -3,7 +3,6 @@
 import edu.harvard.iq.dataverse.Dataverse;
 import edu.harvard.iq.dataverse.EMailValidator;
 import edu.harvard.iq.dataverse.actionlogging.ActionLogRecord;
-import static edu.harvard.iq.dataverse.api.AbstractApiBean.errorResponse;
 import edu.harvard.iq.dataverse.api.dto.RoleDTO;
 import edu.harvard.iq.dataverse.authorization.AuthenticatedUserDisplayInfo;
 import edu.harvard.iq.dataverse.authorization.AuthenticationProvider;
@@ -49,6 +48,7 @@
 import javax.validation.ConstraintViolationException;
 import javax.ws.rs.Produces;
 import javax.ws.rs.core.Response.Status;
+import static edu.harvard.iq.dataverse.api.AbstractApiBean.errorResponse;
 /**
  * Where the secure, setup API calls live.
  * @author michael
@@ -68,9 +68,8 @@ public class Admin extends AbstractApiBean {
     @GET
     public Response listAllSettings() {
         JsonObjectBuilder bld = jsonObjectBuilder();
-        for ( Setting s : settingsSvc.listAll() ) {
-            bld.add(s.getName(), s.getContent());
-        }
+        settingsSvc.listAll().forEach(
+            s -> bld.add(s.getName(), s.getContent())); 
         return okResponse(bld);
     }
     
@@ -593,4 +592,15 @@ public Response convertUserFromBcryptToSha1(String json) {
 
     }
 
+    
+    
+    @Path("assignments/assignees/{raIdtf: .*}")
+    @GET
+    public Response getAssignmentsFor( @PathParam("raIdtf") String raIdtf ) {
+        
+        JsonArrayBuilder arr = Json.createArrayBuilder();
+        roleAssigneeSvc.getAssignmentsFor(raIdtf).forEach( a -> arr.add(json(a)));
+        
+        return okResponse(arr);
+    }
 }
diff --git a/src/main/java/edu/harvard/iq/dataverse/api/BuiltinUsers.java b/src/main/java/edu/harvard/iq/dataverse/api/BuiltinUsers.java
index c5a6f3a9406..2709e17387e 100644
--- a/src/main/java/edu/harvard/iq/dataverse/api/BuiltinUsers.java
+++ b/src/main/java/edu/harvard/iq/dataverse/api/BuiltinUsers.java
@@ -24,8 +24,8 @@
 import javax.ws.rs.QueryParam;
 import javax.ws.rs.core.Response;
 import javax.ws.rs.core.Response.Status;
-import static edu.harvard.iq.dataverse.util.json.JsonPrinter.json;
 import static edu.harvard.iq.dataverse.util.json.JsonPrinter.jsonForAuthUser;
+import static edu.harvard.iq.dataverse.util.json.JsonPrinter.json;
 import java.util.Date;
 
 /**
diff --git a/src/main/java/edu/harvard/iq/dataverse/api/Dataverses.java b/src/main/java/edu/harvard/iq/dataverse/api/Dataverses.java
index 2c0322e719c..3c676f5d665 100644
--- a/src/main/java/edu/harvard/iq/dataverse/api/Dataverses.java
+++ b/src/main/java/edu/harvard/iq/dataverse/api/Dataverses.java
@@ -79,6 +79,7 @@
 import javax.ws.rs.core.Response;
 import javax.ws.rs.core.Response.Status;
 import static edu.harvard.iq.dataverse.util.json.JsonPrinter.json;
+import static edu.harvard.iq.dataverse.util.json.JsonPrinter.toJsonArray;
 
 /**
  * A REST API for dataverses.
@@ -322,7 +323,9 @@ public Response setMetadataRoot( @PathParam("identifier")String dvIdtf, String b
     @Path("{identifier}/facets/")
     public Response listFacets( @PathParam("identifier") String dvIdtf ) {
         try {
-            return okResponse( json(execCommand(new ListFacetsCommand(createDataverseRequest(findUserOrDie()), findDataverseOrDie(dvIdtf)) )));
+            return okResponse(
+                        execCommand(new ListFacetsCommand(createDataverseRequest(findUserOrDie()), findDataverseOrDie(dvIdtf)) )
+                            .stream().map(f->json(f).build()).collect(toJsonArray()));
         } catch (WrappedResponse wr) {
             return wr.getResponse();
         }
@@ -538,7 +541,12 @@ public Response createExplicitGroup( ExplicitGroupDTO dto, @PathParam("identifie
     @Path("{identifier}/groups/") 
     public Response listGroups( @PathParam("identifier") String dvIdtf, @QueryParam("key") String apiKey ) {
         try {
-            return okResponse( json(execCommand(new ListExplicitGroupsCommand(createDataverseRequest(findUserOrDie()), findDataverseOrDie(dvIdtf)) )));
+            JsonArrayBuilder arr = Json.createArrayBuilder();
+            execCommand(new ListExplicitGroupsCommand(createDataverseRequest(findUserOrDie()), findDataverseOrDie(dvIdtf)))
+                        .stream().map( eg->json(eg))
+                    .forEach( arr::add );
+            return okResponse( arr );
+            
         } catch (WrappedResponse wr) {
             return wr.getResponse();
         }
@@ -599,6 +607,7 @@ public Response deleteGroup(@PathParam("identifier") String dvIdtf,
     
     @POST
     @Path("{identifier}/groups/{aliasInOwner}/roleAssignees") 
+    @Consumes("application/json")
     public Response addRoleAssingees(List<String> roleAssingeeIdentifiers, 
                                 @PathParam("identifier") String dvIdtf,
                                 @PathParam("aliasInOwner") String grpAliasInOwner)
diff --git a/src/main/java/edu/harvard/iq/dataverse/api/Groups.java b/src/main/java/edu/harvard/iq/dataverse/api/Groups.java
index bbec80b5bc6..ec6815405d9 100644
--- a/src/main/java/edu/harvard/iq/dataverse/api/Groups.java
+++ b/src/main/java/edu/harvard/iq/dataverse/api/Groups.java
@@ -12,6 +12,7 @@
 import static edu.harvard.iq.dataverse.util.json.JsonPrinter.*;
 import java.util.logging.Level;
 import java.util.logging.Logger;
+import java.util.regex.Pattern;
 import javax.annotation.PostConstruct;
 import javax.json.Json;
 import javax.json.JsonArrayBuilder;
@@ -19,7 +20,9 @@
 import javax.json.JsonString;
 import javax.ws.rs.DELETE;
 import javax.ws.rs.POST;
+import javax.ws.rs.PUT;
 import javax.ws.rs.PathParam;
+
 /**
  *
  * @author michael
@@ -32,22 +35,30 @@ public class Groups extends AbstractApiBean {
     private IpGroupProvider ipGroupPrv;
     private ShibGroupProvider shibGroupPrv;
     
+    Pattern legalGroupName = Pattern.compile("^[-_a-zA-Z0-9]+$");
+    
     @PostConstruct
     void postConstruct() {
         ipGroupPrv = groupSvc.getIpGroupProvider();
         shibGroupPrv = groupSvc.getShibGroupProvider();
     }
     
+    /**
+     * Creates a new {@link IpGroup}. The name of the group is based on the 
+     * {@code alias:} field, but might be changed to ensure uniqueness.
+     * @param dto 
+     * @return Response describing the created group or the error that prevented
+     *         that group from being created.
+     */
     @POST
     @Path("ip")
-    public Response createIpGroups( JsonObject dto ){
+    public Response postIpGroup( JsonObject dto ){
         try {
-           IpGroup grp = new JsonParser(null,null,null).parseIpGroup(dto);
-            
-            if ( grp.getPersistedGroupAlias()== null ) {
-                return errorResponse(Response.Status.BAD_REQUEST, "Must provide valid group alias");
-            }
-            grp.setProvider( groupSvc.getIpGroupProvider() );
+           IpGroup grp = new JsonParser().parseIpGroup(dto);
+            grp.setGroupProvider( ipGroupPrv );
+            grp.setPersistedGroupAlias(
+                    ipGroupPrv.findAvailableName( 
+                            grp.getPersistedGroupAlias()==null ? "ipGroup" : grp.getPersistedGroupAlias()));
             
             grp = ipGroupPrv.store(grp);
             return createdResponse("/groups/ip/" + grp.getPersistedGroupAlias(), json(grp) );
@@ -59,6 +70,35 @@ public Response createIpGroups( JsonObject dto ){
         }
     }
     
+    /**
+     * Creates or updates the {@link IpGroup} named {@code groupName}.
+     * @param groupName Name of the group.
+     * @param dto data of the group.
+     * @return Response describing the created group or the error that prevented
+     *         that group from being created.
+     */
+    @PUT
+    @Path("ip/{groupName}")
+    public Response putIpGroups( @PathParam("groupName") String groupName, JsonObject dto ){
+        try {
+            if ( groupName == null || groupName.trim().isEmpty() ) {
+                return badRequest("Group name cannot be empty");
+            }
+            if ( ! legalGroupName.matcher(groupName).matches() ) {
+                return badRequest("Group name can contain only letters, digits, and the chars '-' and '_'");
+            }
+            IpGroup grp = new JsonParser().parseIpGroup(dto);
+            grp.setGroupProvider( ipGroupPrv );
+            grp.setPersistedGroupAlias( groupName );
+            grp = ipGroupPrv.store(grp);
+            return createdResponse("/groups/ip/" + grp.getPersistedGroupAlias(), json(grp) );
+        
+        } catch ( Exception e ) {
+            logger.log( Level.WARNING, "Error while storing a new IP group: " + e.getMessage(), e);
+            return errorResponse(Response.Status.INTERNAL_SERVER_ERROR, "Error: " + e.getMessage() );
+            
+        }
+    }
     
     @GET
     @Path("ip")
@@ -99,8 +139,18 @@ public Response deleteIpGroup( @PathParam("groupIdtf") String groupIdtf ) {
         try {
             ipGroupPrv.deleteGroup(grp);
             return okResponse("Group " + grp.getAlias() + " deleted.");
-        } catch ( IllegalArgumentException ex ) {
-            return errorResponse(Response.Status.BAD_REQUEST, ex.getMessage());
+        } catch ( Exception topExp ) {
+            // get to the cause (unwraps EJB exception wrappers).
+            Throwable e = topExp;
+            while ( e.getCause() != null ) {
+                e = e.getCause();
+            }
+            
+            if ( e instanceof IllegalArgumentException ) {
+                return errorResponse(Response.Status.BAD_REQUEST, e.getMessage());
+            } else {
+                throw topExp;
+            }
         }
     }
     
diff --git a/src/main/java/edu/harvard/iq/dataverse/api/Index.java b/src/main/java/edu/harvard/iq/dataverse/api/Index.java
index 6ccc228cf32..e217b146dd6 100644
--- a/src/main/java/edu/harvard/iq/dataverse/api/Index.java
+++ b/src/main/java/edu/harvard/iq/dataverse/api/Index.java
@@ -572,7 +572,7 @@ public Response searchDebug(
         int numResultsPerPage = Integer.MAX_VALUE;
         SolrQueryResponse solrQueryResponse;
         try {
-            solrQueryResponse = searchService.search(user, subtreeScope, query, filterQueries, sortField, sortOrder, paginationStart, dataRelatedToMe, numResultsPerPage);
+            solrQueryResponse = searchService.search(createDataverseRequest(user), subtreeScope, query, filterQueries, sortField, sortOrder, paginationStart, dataRelatedToMe, numResultsPerPage);
         } catch (SearchException ex) {
             return errorResponse(Response.Status.INTERNAL_SERVER_ERROR, ex.getLocalizedMessage() + ": " + ex.getCause().getLocalizedMessage());
         }
diff --git a/src/main/java/edu/harvard/iq/dataverse/api/MetadataBlocks.java b/src/main/java/edu/harvard/iq/dataverse/api/MetadataBlocks.java
index 599d8635afa..e0376f71412 100644
--- a/src/main/java/edu/harvard/iq/dataverse/api/MetadataBlocks.java
+++ b/src/main/java/edu/harvard/iq/dataverse/api/MetadataBlocks.java
@@ -11,6 +11,8 @@
 import static edu.harvard.iq.dataverse.util.json.JsonPrinter.json;
 import javax.ws.rs.PathParam;
 import static edu.harvard.iq.dataverse.util.json.JsonPrinter.json;
+import static edu.harvard.iq.dataverse.util.json.JsonPrinter.json;
+import static edu.harvard.iq.dataverse.util.json.JsonPrinter.json;
 
 /**
  * Api bean for managing metadata blocks.
diff --git a/src/main/java/edu/harvard/iq/dataverse/api/Search.java b/src/main/java/edu/harvard/iq/dataverse/api/Search.java
index c65084cedb7..9b8dfeb2045 100644
--- a/src/main/java/edu/harvard/iq/dataverse/api/Search.java
+++ b/src/main/java/edu/harvard/iq/dataverse/api/Search.java
@@ -110,7 +110,7 @@ public Response search(
             SolrQueryResponse solrQueryResponse;
             try {
                 solrQueryResponse = searchService.search(
-                        user,
+                        createDataverseRequest(user),
                         subtree,
                         query,
                         filterQueries,
diff --git a/src/main/java/edu/harvard/iq/dataverse/api/TestApi.java b/src/main/java/edu/harvard/iq/dataverse/api/TestApi.java
index 3483a0c790c..0cebd7dd716 100644
--- a/src/main/java/edu/harvard/iq/dataverse/api/TestApi.java
+++ b/src/main/java/edu/harvard/iq/dataverse/api/TestApi.java
@@ -2,6 +2,12 @@
 
 import edu.harvard.iq.dataverse.DvObject;
 import edu.harvard.iq.dataverse.authorization.RoleAssignee;
+import edu.harvard.iq.dataverse.authorization.groups.impl.explicit.ExplicitGroup;
+import edu.harvard.iq.dataverse.authorization.groups.impl.explicit.ExplicitGroupServiceBean;
+import edu.harvard.iq.dataverse.authorization.groups.impl.ipaddress.IpGroup;
+import edu.harvard.iq.dataverse.authorization.groups.impl.ipaddress.IpGroupsServiceBean;
+import edu.harvard.iq.dataverse.authorization.groups.impl.ipaddress.ip.IPv4Address;
+import edu.harvard.iq.dataverse.authorization.groups.impl.ipaddress.ip.IpAddress;
 import edu.harvard.iq.dataverse.authorization.providers.builtin.PasswordEncryption;
 import edu.harvard.iq.dataverse.authorization.users.User;
 import javax.ejb.Stateless;
@@ -10,8 +16,11 @@
 import javax.ws.rs.PathParam;
 import javax.ws.rs.core.Response;
 import static edu.harvard.iq.dataverse.util.json.JsonPrinter.*;
+import edu.harvard.iq.dataverse.util.json.NullSafeJsonBuilder;
+import java.util.Set;
 import java.util.logging.Level;
 import java.util.logging.Logger;
+import javax.ejb.EJB;
 import javax.json.Json;
 import javax.json.JsonObjectBuilder;
 import javax.ws.rs.QueryParam;
@@ -33,6 +42,12 @@
 public class TestApi extends AbstractApiBean {
     private static final Logger logger = Logger.getLogger(TestApi.class.getName());
     
+    @EJB
+    ExplicitGroupServiceBean explicitGroups;
+    
+    @EJB
+    IpGroupsServiceBean ipGroupsSvc;
+    
     @Path("echo/{whatever}")
     @GET
     public Response echo( @PathParam("whatever") String body ) {
@@ -97,4 +112,36 @@ public Response testUserLookup() {
             return ex.getResponse();
         }
     }
+    
+    @Path("explicitGroups/{identifier: .*}")
+    @GET
+    public Response explicitGroupMembership( @PathParam("identifier") String idtf) {
+        final RoleAssignee roleAssignee = roleAssigneeSvc.getRoleAssignee(idtf);
+        if (roleAssignee==null ) {
+            return notFound("Can't find a role assignee with identifier " + idtf);
+        }
+        Set<ExplicitGroup> groups = explicitGroups.findGroups(roleAssignee);
+        logger.log(Level.INFO, "Groups for {0}: {1}", new Object[]{roleAssignee, groups});
+        return okResponse( groups.stream().map( g->json(g).build()).collect(toJsonArray()) );
+    }
+    
+    @Path("ipGroups/containing/{address}")
+    @GET
+    public Response getIpGroupsContaining( @PathParam("address") String addrStr ) {
+        try {
+            IpAddress addr = IpAddress.valueOf(addrStr);
+            
+            JsonObjectBuilder r = NullSafeJsonBuilder.jsonObjectBuilder();
+            r.add( "address", addr.toString() );
+            r.add( "addressRaw", (addr instanceof IPv4Address) ? ((IPv4Address)addr).toBigInteger().toString(): null);
+            r.add("groups", ipGroupsSvc.findAllIncludingIp(addr).stream()
+                    .map( IpGroup::toString )
+                    .collect(stringsToJsonArray()));
+            return okResponse( r );
+            
+        } catch ( IllegalArgumentException iae ) {
+            return badRequest(addrStr + " is not a valid address: " + iae.getMessage());
+        }
+    }
+    
 }
diff --git a/src/main/java/edu/harvard/iq/dataverse/authorization/MyDataQueryHelper.java b/src/main/java/edu/harvard/iq/dataverse/authorization/MyDataQueryHelper.java
deleted file mode 100644
index 3a06c0a02a1..00000000000
--- a/src/main/java/edu/harvard/iq/dataverse/authorization/MyDataQueryHelper.java
+++ /dev/null
@@ -1,96 +0,0 @@
-/*
- * To change this license header, choose License Headers in Project Properties.
- * To change this template file, choose Tools | Templates
- * and open the template in the editor.
- */
-package edu.harvard.iq.dataverse.authorization;
-
-import edu.harvard.iq.dataverse.authorization.users.AuthenticatedUser;
-import java.util.ArrayList;
-
-/**
- *
- * @author skraffmiller
- */
-public class MyDataQueryHelper {
-
-    private AuthenticatedUser user;
-    private ArrayList<String> dvObjectTypes;
-    private ArrayList<Long> directIds;
-    private ArrayList<Long> parentIds;
-    private final MyDataQueryHelperServiceBean myDataQueryHelperService;
-
-    public MyDataQueryHelper(AuthenticatedUser user, MyDataQueryHelperServiceBean injectedBean) {
-        this.user = user;
-        myDataQueryHelperService = injectedBean;
-        initializeLists();
-    }
-
-    private void initializeLists() {
-        initializeParentIds();
-        initializeDirectIds();
-    }
-
-    private void initializeParentIds() {
-        parentIds = new ArrayList();
-        parentIds.addAll(myDataQueryHelperService.getParentIds("Dataverse", "DataFile",  this.user));
-        parentIds.addAll(myDataQueryHelperService.getParentIds("Dataset", "DataFile",  this.user));
-        parentIds.addAll(myDataQueryHelperService.getParentIds("Dataverse", "Dataset",  this.user));
-    }
-
-    private void initializeDirectIds() {
-        directIds = new ArrayList();
-        directIds.addAll(myDataQueryHelperService.getDirectQuery(this.user).getResultList());
-    }
-
-    public String getSolrQueryString() {
-        /*(entityId:(20 11 592 7 17 24 14 15 21 18 25 19 22 23 12 2 8 3 16 4 9 5 13 6 10))*/
-
-        String retPrimaryString = "entityId:(";
-        if (this.directIds != null && !this.directIds.isEmpty()) {
-            for (Object id : this.directIds) {
-                Integer r1 = (Integer) id;
-                retPrimaryString += " " + r1;
-            }
-        }
-        retPrimaryString += ")";
-
-        String retParentString;
-
-        if (!getParentIds().isEmpty()) {
-            retParentString = "parentId:(";
-
-            for (Long id : getParentIds()) {
-                retParentString += " " + id;
-            }
-            retParentString += ")";
-            return "" + retPrimaryString + " OR " + retParentString + "";
-        }
-        return "" + retPrimaryString;
-    }
-
-    public AuthenticatedUser getUser() {
-        return user;
-    }
-
-    public void setUser(AuthenticatedUser user) {
-        this.user = user;
-    }
-
-    public ArrayList<String> getDvObjectTypes() {
-        return dvObjectTypes;
-    }
-
-    public void setDvObjectTypes(ArrayList<String> dvObjectTypes) {
-        this.dvObjectTypes = dvObjectTypes;
-    }
-
-    public ArrayList<Long> getParentIds() {
-        return parentIds;
-    }
-
-    public void setParentIds(ArrayList<Long> parentIds) {
-        this.parentIds = parentIds;
-    }
-
-}
diff --git a/src/main/java/edu/harvard/iq/dataverse/authorization/MyDataQueryHelperServiceBean.java b/src/main/java/edu/harvard/iq/dataverse/authorization/MyDataQueryHelperServiceBean.java
deleted file mode 100644
index 2bd577ceb5d..00000000000
--- a/src/main/java/edu/harvard/iq/dataverse/authorization/MyDataQueryHelperServiceBean.java
+++ /dev/null
@@ -1,198 +0,0 @@
-/*
- * To change this license header, choose License Headers in Project Properties.
- * To change this template file, choose Tools | Templates
- * and open the template in the editor.
- */
-package edu.harvard.iq.dataverse.authorization;
-
-import edu.harvard.iq.dataverse.DataverseRoleServiceBean;
-import edu.harvard.iq.dataverse.DvObject;
-import edu.harvard.iq.dataverse.DvObjectServiceBean;
-import edu.harvard.iq.dataverse.RoleAssigneeServiceBean;
-import edu.harvard.iq.dataverse.authorization.users.AuthenticatedUser;
-import edu.harvard.iq.dataverse.mydata.MyDataFinder;
-import java.util.ArrayList;
-import java.util.List;
-import javax.ejb.EJB;
-import javax.ejb.Stateless;
-import javax.persistence.EntityManager;
-import javax.persistence.PersistenceContext;
-import javax.persistence.Query;
-import org.apache.commons.lang.StringUtils;
-
-/**
- *
- * @author skraffmi
- */
-@Stateless
-public class MyDataQueryHelperServiceBean {
-    
-    
-    @PersistenceContext(unitName = "VDCNet-ejbPU")
-    private EntityManager em;
-
-    @EJB
-    DataverseRoleServiceBean roleService;
-    
-    @EJB
-    DvObjectServiceBean dvObjectService;
-    
-    @EJB
-    DataverseRoleServiceBean dataverseRoleService;
-    
-    @EJB
-    RoleAssigneeServiceBean roleAssigneeService;
-    
-    public Query getDirectQuery( AuthenticatedUser user) {
-        return em.createNativeQuery("SELECT id FROM dvobject WHERE "
-                + " id in (select definitionpoint_id from roleassignment where assigneeidentifier in ('" + user.getIdentifier() + "'));");
-    }
-
-    public List<Long> getParentIds(String dtypeParent, String dtypeChild, AuthenticatedUser user) {
-        
-        List<DataverseRole> roleList = roleService.findAll();
-
-        DataverseRolePermissionHelper rolePermissionHelper = new DataverseRolePermissionHelper(roleList);
-        List<Long> retVal = new ArrayList();
-        List<Object[]> results = em.createNativeQuery("Select distinct role.role_id, dvo.id FROM dvobject dvo, roleassignment role WHERE  "
-                + " dtype = '" + dtypeParent + "'"
-                + " and dvo.id = role.definitionpoint_id"
-                + " and role.role_id in (select role_id from roleassignment where assigneeidentifier in ('" + user.getIdentifier() + "') "
-                + ");").getResultList();
-        for (Object[] result : results) {
-            Long role_id = (Long) result[0];
-            
-            if (dtypeParent.equals("Dataverse") && dtypeChild.equals("Dataset") && rolePermissionHelper.hasDatasetPermissions(role_id)) {
-                Integer r1 = (Integer) result[1];
-                retVal.add(r1.longValue());
-            }
-
-            if (dtypeParent.equals("Dataverse") && dtypeChild.equals("DataFile") && rolePermissionHelper.hasFilePermissions(role_id)) {
-                List<Object> dsIds = em.createNativeQuery("Select id from dvobject where dtype = 'Dataset' and owner_id = " + (Integer) result[1] + ";").getResultList();
-                for (Object dsId : dsIds) {
-                    Integer r1 = (Integer) dsId;
-                    retVal.add(r1.longValue());
-                }
-            }
-
-            if (dtypeParent.equals("Dataset")) {
-                if (rolePermissionHelper.hasFilePermissions(role_id)) {
-                    Integer r1 = (Integer) result[1];
-                    retVal.add(r1.longValue());
-                }
-            }
-        }
-        return retVal;
-    }
-    
-     private String getRoleIdListClause(List<Long> roleIdList){
-        if (roleIdList == null){
-            return "";
-        }
-        List<String> outputList = new ArrayList<>();
-        
-        for(Long r : roleIdList){
-            if (r != null){
-                outputList.add(r.toString());
-            }
-        }
-        if (outputList.isEmpty()){
-            return "";
-        }        
-        return " AND role.role_id IN (" + StringUtils.join(outputList, ",") + ")";        
-    }
-    
-    public List<String> getRolesOnDVO(AuthenticatedUser user, Long dvoId, List<Long> roleIdList, MyDataFinder finder) {
-
-        List<String> retVal = new ArrayList();
-
-        DvObject objectIn = dvObjectService.findDvObject(dvoId);
-        List idsForSelect = new ArrayList();
-        
-        for (Long roleId : roleIdList) {
-
-            if (objectIn.isInstanceofDataverse()){
-                idsForSelect.add(roleId);
-            }
-            if (objectIn.isInstanceofDataset() && (finder.getRolePermissionHelper().hasDatasetPermissions(roleId) || finder.getRolePermissionHelper().hasFilePermissions(roleId))){
-                idsForSelect.add(roleId);
-            }
-            if (objectIn.isInstanceofDataFile() &&  finder.getRolePermissionHelper().hasFilePermissions(roleId)){
-                idsForSelect.add(roleId);
-            }
-
-        }
-        
-        List<Long> roles = roleAssigneeService.getRoleIdListForGivenAssigneeDvObject(user, idsForSelect, dvoId);
-        
-       /* List<Object> results = em.createNativeQuery("Select distinct role.role_id FROM roleassignment role WHERE  "
-                + " role.definitionpoint_id = " + dvoId + " "
-                + " and role.role_id in (select role_id from roleassignment where assigneeidentifier in ('" + user.getIdentifier() + "') "
-                + ")"
-                + roleClause
-                + ";").getResultList();*/
-        if (roles != null && !roles.isEmpty()) {
-            for (Object result : roles) {
-                Long role_id = (Long) result;
-                DataverseRole role = roleService.find(role_id);
-                if (!retVal.contains(role.getName())) {
-                    retVal.add(role.getName());
-                }
-            }
-        }
-        //If there are roles on the object return
-        //else continue to parent
-        if (!retVal.isEmpty()){
-            return retVal;
-        }
-        
-        Object parentObj = em.createNativeQuery("Select owner_id from dvobject where id = " + dvoId).getSingleResult();
-        Long parentId = (Long) parentObj;
-        /*
-        List<Object> resultsParent = em.createNativeQuery("Select distinct role.role_id FROM roleassignment role WHERE  "
-                + " role.definitionpoint_id = " + parentId + " "
-                + " and role.role_id in (select role_id from roleassignment where assigneeidentifier in ('" + user.getIdentifier() + "') "
-                + ")"
-                + roleClause
-                + ";").getResultList();*/
-        List<Long> resultsParent = roleAssigneeService.getRoleIdListForGivenAssigneeDvObject(user, idsForSelect, parentId);
-        if (resultsParent != null && !resultsParent.isEmpty()) {
-            for (Object result : resultsParent) {
-                Long role_id = (Long) result;
-                DataverseRole role = roleService.find(role_id);
-                if (!retVal.contains(role.getName())) {
-                    retVal.add(role.getName());
-                }
-            }
-        }
-        //If there are roles on the parent return
-        //else continue to grandparent
-        if (!retVal.isEmpty()){
-            return retVal;
-        }
-        
-        Object GrandParentObj = em.createNativeQuery("Select owner_id from dvobject where id = " + parentId).getSingleResult();
-        Long grandParentId = (Long) GrandParentObj;
-        /*
-        List<Object> resultsGrandParent = em.createNativeQuery("Select distinct role.role_id FROM roleassignment role WHERE  "
-                + " role.definitionpoint_id = " + grandParentId + " "
-                + " and role.role_id in (select role_id from roleassignment where assigneeidentifier in ('" + user.getIdentifier() + "') "
-                + ")"
-                + roleClause
-                + ";").getResultList();
-                */
-        List<Long> resultsGrandParent = roleAssigneeService.getRoleIdListForGivenAssigneeDvObject(user, idsForSelect, grandParentId);
-        if (resultsGrandParent != null && !resultsGrandParent.isEmpty()) {
-            for (Object result : resultsGrandParent) {
-                Long role_id = (Long) result;
-                DataverseRole role = roleService.find(role_id);
-                if (!retVal.contains(role.getName())) {
-                    retVal.add(role.getName());
-                }
-            }
-        }
-
-        return retVal;
-    }
-
-}
diff --git a/src/main/java/edu/harvard/iq/dataverse/authorization/groups/GroupProvider.java b/src/main/java/edu/harvard/iq/dataverse/authorization/groups/GroupProvider.java
index 9029d2947b1..84dd944191a 100644
--- a/src/main/java/edu/harvard/iq/dataverse/authorization/groups/GroupProvider.java
+++ b/src/main/java/edu/harvard/iq/dataverse/authorization/groups/GroupProvider.java
@@ -29,19 +29,20 @@ public interface GroupProvider<T extends Group> {
     
     /**
      * Looks up the groups this provider has for a dataverse request, in the context of a {@link DvObject}.
-     * @param req The request whose group memberships we evaluate
-     * @param dvo the DvObject which is the context for the groups. May be {@code null}
+     * @param req The request whose group memberships we evaluate.
+     * @param dvo the DvObject which is the context for the groups. May be {@code null}.
      * @return The set of groups the user is member of.
      */
     public Set<T> groupsFor( DataverseRequest req, DvObject dvo );
     
     /**
      * Looks up the groups this provider has for a role assignee, in the context of a {@link DvObject}.
-     * This method should be used for group management. Groups for actual requests should be determined
-     * by calling {@link #groupsFor(edu.harvard.iq.dataverse.engine.command.DataverseRequest, edu.harvard.iq.dataverse.DvObject)}.
+     * <B>This method should be used for group management. Groups for actual requests should be determined
+     * by calling {@link #groupsFor(edu.harvard.iq.dataverse.engine.command.DataverseRequest, edu.harvard.iq.dataverse.DvObject)}.</B>
      * @param ra 
      * @param dvo the DvObject which is the context for the groups. May be {@code null}
      * @return The set of groups the role assignee is a member of.
+     * @see #groupsFor(edu.harvard.iq.dataverse.engine.command.DataverseRequest, edu.harvard.iq.dataverse.DvObject)
      */
     public Set<T> groupsFor( RoleAssignee ra, DvObject dvo );
     
diff --git a/src/main/java/edu/harvard/iq/dataverse/authorization/groups/GroupServiceBean.java b/src/main/java/edu/harvard/iq/dataverse/authorization/groups/GroupServiceBean.java
index 5f494757d66..2ee8c55daa6 100644
--- a/src/main/java/edu/harvard/iq/dataverse/authorization/groups/GroupServiceBean.java
+++ b/src/main/java/edu/harvard/iq/dataverse/authorization/groups/GroupServiceBean.java
@@ -13,12 +13,15 @@
 import edu.harvard.iq.dataverse.authorization.groups.impl.shib.ShibGroupServiceBean;
 import edu.harvard.iq.dataverse.authorization.users.AuthenticatedUser;
 import edu.harvard.iq.dataverse.engine.command.DataverseRequest;
+import java.util.Collection;
 import java.util.HashMap;
 import java.util.HashSet;
 import java.util.Map;
 import java.util.Set;
 import java.util.logging.Level;
 import java.util.logging.Logger;
+import static java.util.stream.Collectors.toSet;
+import java.util.stream.Stream;
 import javax.annotation.PostConstruct;
 import javax.ejb.EJB;
 import javax.ejb.Stateless;
@@ -76,14 +79,19 @@ public ShibGroupProvider getShibGroupProvider() {
         return shibGroupProvider;
     }
     
+    /**
+     * Finds all the groups {@code req} is part of in {@code dvo}'s context.
+     * Recurses upwards in {@link ExplicitGroup}s, as needed.
+     * @param req The request whose group memberships we seek.
+     * @param dvo The {@link DvObject} we determining the context fo the membership.
+     * @return The groups {@code req} is part of under {@code dvo}.
+     */
     public Set<Group> groupsFor( DataverseRequest req, DvObject dvo ) {
-        Set<Group> groups = new HashSet<>();
-         // first, get all groups the user directly belongs to
-        for ( GroupProvider gp : groupProviders.values() ) {
-            groups.addAll( gp.groupsFor(req, dvo) );
-        }
-        
-        return groupTransitiveClosure(groups, dvo);
+        return groupTransitiveClosure(
+                groupProviders.values().stream()
+                              .flatMap(gp->(Stream<Group>)gp.groupsFor(req, dvo).stream())
+                              .collect(toSet()),
+                dvo);
     }
     
     /**
@@ -94,14 +102,11 @@ public Set<Group> groupsFor( DataverseRequest req, DvObject dvo ) {
      * @return 
      */
     public Set<Group> groupsFor( RoleAssignee ra, DvObject dvo ) {
-        Set<Group> groups = new HashSet<>();
-        
-        // first, get all groups the user directly belongs to
-        for ( GroupProvider gp : groupProviders.values() ) {
-            groups.addAll( gp.groupsFor(ra, dvo) );
-        }
-        
-        return groupTransitiveClosure(groups, dvo);
+        return groupTransitiveClosure(
+                groupProviders.values().stream()
+                              .flatMap(gp->(Stream<Group>)gp.groupsFor(ra, dvo).stream())
+                              .collect( toSet() ),
+                dvo);
     }
 
     /**
@@ -109,36 +114,106 @@ public Set<Group> groupsFor( RoleAssignee ra, DvObject dvo ) {
      * groups a Role assignee belongs to as advertised but this method comes
      * closer.
      *
-     * @todo Determine if this method works with IP Groups.
-     *
      * @param au An AuthenticatedUser.
      * @return As many groups as we can find for the AuthenticatedUser.
+     * 
+     * @deprecated Does not look into IP Groups. Use {@link #groupsFor(edu.harvard.iq.dataverse.engine.command.DataverseRequest)}
      */
+    @Deprecated
     public Set<Group> groupsFor(AuthenticatedUser au) {
         Set<Group> groups = new HashSet<>();
         groups.addAll(groupsFor(au, null));
         String identifier = au.getIdentifier();
-        String identifierWithoutAtSign = null;
         if (identifier != null) {
             try {
-                identifierWithoutAtSign = identifier.substring(1);
+                groups.addAll( explicitGroupService.findGroups(au) );
             } catch (IndexOutOfBoundsException ex) {
-                logger.info("Couldn't trim first character (@ sign) from identifier: " + identifier);
+                logger.log(Level.INFO, "Couldn''t trim first character (@ sign) from identifier: {0}", identifier);
             }
         }
-        if (identifierWithoutAtSign != null) {
-            roleAssigneeSvc.getUserExplicitGroups(identifierWithoutAtSign).stream().forEach((groupAlias) -> {
-                ExplicitGroup explicitGroup = explicitGroupProvider.get(groupAlias);
-                if (explicitGroup != null) {
-                    groups.add(explicitGroup);
-                } else {
-                    logger.info("Couldn't find group based on alias " + groupAlias);
+
+        return groups;
+    }
+
+    
+    public Set<Group> groupsFor( DataverseRequest dr ) {
+        Set<Group> groups = new HashSet<>();
+        
+        // get the global groups
+        groups.addAll( groupsFor(dr,null) );
+        
+        // add the explicit groups
+        groups.addAll( explicitGroupService.findGroups(dr.getUser()) );
+        
+        return groups;
+    }
+    
+    /**
+     * Collections of groups may include {@link ExplicitGroup}s, which have a 
+     * recursive structure (more precisely, a Composite Pattern}. This has many 
+     * advantages, but it makes answering the question "which groups are 
+     * contained in this group" non-trivial. This method deals with this issue by
+     * providing a "flat list" of the groups contained in the groups at the 
+     * passed collection.
+     * 
+     * The resultant stream is distinct - groups appear in it only once, even if
+     * some of them are members of multiple groups.
+     * 
+     * @param groups A collection of groups
+     * @return A distinct stream of groups who are members of, or are 
+     * descendants of members of the groups in {@code groups}.
+     */
+    public Stream<Group> flattenGroupsCollection( Collection<Group> groups ) {
+        Stream.Builder<Group> out = Stream.builder();
+        groups.forEach( g -> {
+            out.accept(g);
+            if ( g instanceof ExplicitGroup ) {
+                collectGroupContent((ExplicitGroup) g, out);
+            } 
+        });
+        return out.build().distinct();
+    }
+    
+    private void collectGroupContent( ExplicitGroup eg, Stream.Builder<Group> out ) {
+        eg.getContainedRoleAssgineeIdentifiers().stream()
+                .map( idtf -> roleAssigneeSvc.getRoleAssignee(idtf) )
+                .filter( asn -> asn instanceof Group )
+                .forEach( group ->  out.accept((Group)group) );
+        
+        eg.getContainedExplicitGroups().forEach( meg -> {
+            out.accept(meg);
+            collectGroupContent(meg, out);
+        });
+    }
+    
+    /**
+     * Returns all the groups that are in, of are ancestors of a group in
+     * the passed group collection.
+     * 
+     * @param groups 
+     * @return {@code groups} and their ancestors.
+     */
+    public Set<Group> collectAncestors( Collection<Group> groups ) {
+        // Ancestors will be collected here.
+        Set<Group> retVal = new HashSet<>(); 
+        
+         // Groups whose ancestors were not collected yet.
+        Set<Group> perimeter = new HashSet(groups);
+        
+        while ( ! perimeter.isEmpty() ) {
+            Group next = perimeter.iterator().next();
+            retVal.add(next);
+            perimeter.remove(next);
+            explicitGroupService.findDirectlyContainingGroups(next).forEach( g -> {
+                if ( ! retVal.contains(g) ) {
+                    perimeter.add( g );
                 }
             });
         }
-        return groups;
+        
+        return retVal;
     }
-
+    
     /**
      * Given a set of groups and a DV object, return all the groups that are
      * reachable from the set. Effectively, if the initial set has an {@link ExplicitGroup},
@@ -153,11 +228,9 @@ private Set<Group> groupTransitiveClosure(Set<Group> groups, DvObject dvo) {
         Set<ExplicitGroup> perimeter = new HashSet<>();
         Set<ExplicitGroup> visited = new HashSet<>();
         
-        for ( Group g : groups ) {
-            if ( g instanceof ExplicitGroup ) {
-                perimeter.add((ExplicitGroup) g);
-            }
-        }
+        groups.stream()
+              .filter((g) -> ( g instanceof ExplicitGroup ))
+              .forEachOrdered((g) -> perimeter.add((ExplicitGroup) g));
         visited.addAll(perimeter);
         
         while ( ! perimeter.isEmpty() ) {
@@ -179,9 +252,8 @@ private Set<Group> groupTransitiveClosure(Set<Group> groups, DvObject dvo) {
     
     public Set<Group> findGlobalGroups() {
         Set<Group> groups = new HashSet<>();
-        for ( GroupProvider gp : groupProviders.values() ) {
-            groups.addAll( gp.findGlobalGroups() );
-        }
+        groupProviders.values().forEach( 
+                gp-> groups.addAll( gp.findGlobalGroups() ));
         return groups;
     }
     
diff --git a/src/main/java/edu/harvard/iq/dataverse/authorization/groups/impl/PersistedGlobalGroup.java b/src/main/java/edu/harvard/iq/dataverse/authorization/groups/impl/PersistedGlobalGroup.java
index e2db4551ea8..52785d5c7e2 100644
--- a/src/main/java/edu/harvard/iq/dataverse/authorization/groups/impl/PersistedGlobalGroup.java
+++ b/src/main/java/edu/harvard/iq/dataverse/authorization/groups/impl/PersistedGlobalGroup.java
@@ -31,7 +31,7 @@ public abstract class PersistedGlobalGroup implements Group, Serializable {
     private Long id;
     
     /**
-     * A unique alias within the persisted group table. 
+     * A unique alias within the Dataverse system installation.
      */
     @Column(unique = true)
     private String persistedGroupAlias;
diff --git a/src/main/java/edu/harvard/iq/dataverse/authorization/groups/impl/builtin/BuiltInGroupsProvider.java b/src/main/java/edu/harvard/iq/dataverse/authorization/groups/impl/builtin/BuiltInGroupsProvider.java
index 27fcfec3a73..cb6da272dda 100644
--- a/src/main/java/edu/harvard/iq/dataverse/authorization/groups/impl/builtin/BuiltInGroupsProvider.java
+++ b/src/main/java/edu/harvard/iq/dataverse/authorization/groups/impl/builtin/BuiltInGroupsProvider.java
@@ -5,6 +5,7 @@
 import edu.harvard.iq.dataverse.authorization.groups.Group;
 import edu.harvard.iq.dataverse.authorization.groups.GroupProvider;
 import edu.harvard.iq.dataverse.authorization.users.AuthenticatedUser;
+import edu.harvard.iq.dataverse.authorization.users.User;
 import edu.harvard.iq.dataverse.engine.command.DataverseRequest;
 import java.util.Collections;
 import java.util.Set;
@@ -44,9 +45,13 @@ public Set<Group> groupsFor(DataverseRequest req, DvObject dvo ) {
 
     @Override
     public Set<Group> groupsFor( RoleAssignee ra, DvObject dvo ) {
-        return (Set<Group>) ((ra instanceof AuthenticatedUser)
-                ? CollectionHelper.asSet(AllUsers.get(), AuthenticatedUsers.get())
-                : Collections.singleton(AllUsers.get()));
+        if ( ra instanceof User) {
+            return (Set<Group>) ((ra instanceof AuthenticatedUser)
+                    ? CollectionHelper.asSet(AllUsers.get(), AuthenticatedUsers.get())
+                    : Collections.singleton(AllUsers.get()));
+        } else {
+            return Collections.emptySet();
+        }
     }
     
     @Override
diff --git a/src/main/java/edu/harvard/iq/dataverse/authorization/groups/impl/explicit/ExplicitGroup.java b/src/main/java/edu/harvard/iq/dataverse/authorization/groups/impl/explicit/ExplicitGroup.java
index d732557af75..33a29971906 100644
--- a/src/main/java/edu/harvard/iq/dataverse/authorization/groups/impl/explicit/ExplicitGroup.java
+++ b/src/main/java/edu/harvard/iq/dataverse/authorization/groups/impl/explicit/ExplicitGroup.java
@@ -7,6 +7,7 @@
 import edu.harvard.iq.dataverse.authorization.RoleAssigneeDisplayInfo;
 import edu.harvard.iq.dataverse.authorization.users.User;
 import edu.harvard.iq.dataverse.authorization.groups.GroupException;
+import edu.harvard.iq.dataverse.authorization.groups.impl.ipaddress.ip.IpAddress;
 import edu.harvard.iq.dataverse.engine.command.DataverseRequest;
 import java.util.HashSet;
 import java.util.Objects;
@@ -56,12 +57,21 @@
                       +"WHERE eg.owner.id=:ownerId AND ceg.id=:subExGroupId"),
     @NamedQuery( name="ExplicitGroup.findByOwnerAndRAIdtf",
                  query="SELECT eg FROM ExplicitGroup eg join eg.containedRoleAssignees ra "
-                      +"WHERE eg.owner.id=:ownerId AND ra=:raIdtf")
+                      +"WHERE eg.owner.id=:ownerId AND ra=:raIdtf"),
+    @NamedQuery( name="ExplicitGroup.findByAuthenticatedUserIdentifier",
+                 query="SELECT eg FROM ExplicitGroup eg JOIN eg.containedAuthenticatedUsers au "
+                     + "WHERE au.userIdentifier=:authenticatedUserIdentifier"),
+    @NamedQuery( name="ExplicitGroup.findByRoleAssgineeIdentifier",
+                 query="SELECT eg FROM ExplicitGroup eg JOIN eg.containedRoleAssignees cra "
+                     + "WHERE cra=:roleAssigneeIdentifier"),
+    @NamedQuery( name="ExplicitGroup.findByContainedExplicitGroupId",
+                 query="SELECT eg FROM ExplicitGroup eg join eg.containedExplicitGroups ceg "
+                      +"WHERE ceg.id=:containedExplicitGroupId")
+        
 })
 @Entity
-@Table(indexes = {@Index(columnList="owner_id")
-		//, @Index(columnList="groupalias") //@unique takes care of this
-		, @Index(columnList="groupaliasinowner")})
+@Table(indexes = {@Index(columnList="owner_id"),
+                  @Index(columnList="groupaliasinowner")})
 public class ExplicitGroup implements Group, java.io.Serializable {
     
     @Id
@@ -149,7 +159,8 @@ public void add( User u ) {
      * Adds the {@link RoleAssignee} to {@code this} group. 
      * 
      * @param ra the role assignee to be added to this group.
-     * @throws GroupException if {@code ra} is a group, and is an ancestor of {@code this}.
+     * @throws GroupException if {@code ra} is a group, and is either an ancestor of {@code this},
+     *         or is defined in a dataverse that is not an ancestor of {@code this.owner}.
      */
     public void add( RoleAssignee ra ) throws GroupException {
         
@@ -164,10 +175,14 @@ public void add( RoleAssignee ra ) throws GroupException {
             if ( ra instanceof ExplicitGroup ) {
                 // validate no circular deps
                 ExplicitGroup g = (ExplicitGroup) ra;
-                if ( g.contains(this) ) {
+                if ( g.structuralContains(this) ) {
                     throw new GroupException(this, "A group cannot be added to one of its childs.");
                 }
-                containedExplicitGroups.add( g );
+                if ( g.owner.isAncestorOf(owner) ) {
+                    containedExplicitGroups.add( g );
+                } else {
+                    throw new GroupException(this, "Cannot add " + g + ", as it is not defined in " + owner + " or one of its ancestors.");
+                }
             } else {
                 containedRoleAssignees.add( ra.getIdentifier() );
             }
@@ -219,6 +234,26 @@ public void removeByRoleAssgineeIdentifier( String idtf ) {
         }
     }
     
+    /**
+     * Returns a set of all direct members of the group, including 
+     * logical role assignees.
+     * @return members of the group.
+     */
+    public Set<RoleAssignee> getDirectMembers() {
+        Set<RoleAssignee> res = new HashSet<>();
+        
+        res.addAll( containedExplicitGroups );
+        res.addAll( containedAuthenticatedUsers );
+        for ( String idtf : containedRoleAssignees ) {
+            RoleAssignee ra = provider.findRoleAssignee(idtf);
+            if ( ra != null ) {
+                res.add(ra);
+            }
+        }
+        
+        return res;
+    }
+    
     @Override
     public String getDescription() {
         return description;
@@ -230,42 +265,89 @@ public void setDescription(String description) {
 
     @Override
     public boolean contains(DataverseRequest req) {
-        return contains( req.getUser() );
-    }
-    
-    public boolean contains(RoleAssignee ra) {
-        return containsDirectly(ra) || containsIndirectly(ra);
+        return containsDirectly(req) || containsIndirectly(req);
     }
     
-    protected boolean containsDirectly( RoleAssignee ra ) {
+    /**
+     * Looks at structural containment: whether {@code ra} is part of the
+     * group's structure. It mostly the same as {@link #contains(edu.harvard.iq.dataverse.engine.command.DataverseRequest)},
+     * except for logical containment. So if an ExplicitGroup contains {@link AuthenticatedUsers} but not
+     * a specific {@link AuthenticatedUser} {@code u}, {@code structuralContains(u)}
+     * would return {@code false} while {@code contains( request(u, ...) )} would return true;
+     * 
+     * @param ra
+     * @return {@code true} iff the role assignee is structurally a part of the group.
+     */
+    public boolean structuralContains(RoleAssignee ra) {
+        // direct containment
         if ( ra instanceof AuthenticatedUser ) {
-            AuthenticatedUser au = (AuthenticatedUser) ra;
-            return containedAuthenticatedUsers.contains(au);
+            if ( containedAuthenticatedUsers.contains((AuthenticatedUser)ra) ) {
+                return true;
+            }
             
         } else if ( ra instanceof ExplicitGroup ) {
-            ExplicitGroup eg = (ExplicitGroup) ra;
-            return containedExplicitGroups.contains(eg);
+            if ( containedExplicitGroups.contains((ExplicitGroup)ra) ) { 
+                return true;
+            }
             
         } else {
-           return containedRoleAssignees.contains( ra.getIdentifier() );
+            if ( containedRoleAssignees.contains(ra.getIdentifier()) ) {
+                return true;
+            }
         }
-    }
-
-    private boolean containsIndirectly(RoleAssignee ra) {
-        for ( ExplicitGroup ceg : containedExplicitGroups ) {
-            if ( ceg.contains(ra) ) {
+        
+        // no direct containment. Recurse.
+        for ( ExplicitGroup eg: containedExplicitGroups ) {
+            if ( eg.structuralContains(ra) ) {
                 return true;
             }
         }
         
-        for ( String containedRAIdtf : containedRoleAssignees ) {
-            RoleAssignee containedRa = provider.findRoleAssignee(containedRAIdtf);
-            if ( containedRa != null ) {
-                if ( containedRa instanceof ExplicitGroup ) {
-                    if (((ExplicitGroup)containedRa).contains(ra)) {
+        return false;
+        
+    }
+    
+    /**
+     * @param req
+     * @return {@code true} iff the request is contained in the group or in an included non-explicit group.
+     */
+    protected boolean containsDirectly( DataverseRequest req ) {
+        User ra = req.getUser();
+        if ( ra instanceof AuthenticatedUser ) {
+            AuthenticatedUser au = (AuthenticatedUser) ra;
+            if ( containedAuthenticatedUsers.contains(au) ) {
+                return true;
+            }    
+        } 
+        
+        if ( containedRoleAssignees.contains(ra.getIdentifier()) ) {
+            return true;
+        }
+        
+        for ( String craIdtf : containedRoleAssignees ) {
+            // Need to retrieve the actual role assingee, and let it's logic decide.
+            RoleAssignee cra = provider.findRoleAssignee(craIdtf);
+            if ( cra != null ) {
+                if ( cra instanceof Group ) {
+                    Group cgrp = (Group) cra;
+                    if ( cgrp.contains(req) ) {
                         return true;
                     }
-                }
+                } // if cra is a user, we would have returned after the .contains() test.
+            } 
+        }
+       // If we get here, the request is not in this group.
+       return false;
+    }
+
+    /**
+     * @param req
+     * @return {@code true} iff the request if contained in an explicit group that's a member of this group.
+     */
+    private boolean containsIndirectly(DataverseRequest req) {
+        for ( ExplicitGroup ceg : containedExplicitGroups ) {
+            if ( ceg.contains(req) ) {
+                return true;
             }
         }
         return false;
diff --git a/src/main/java/edu/harvard/iq/dataverse/authorization/groups/impl/explicit/ExplicitGroupServiceBean.java b/src/main/java/edu/harvard/iq/dataverse/authorization/groups/impl/explicit/ExplicitGroupServiceBean.java
index e6435ef6431..51174e24ba9 100644
--- a/src/main/java/edu/harvard/iq/dataverse/authorization/groups/impl/explicit/ExplicitGroupServiceBean.java
+++ b/src/main/java/edu/harvard/iq/dataverse/authorization/groups/impl/explicit/ExplicitGroupServiceBean.java
@@ -10,6 +10,7 @@
 import java.util.List;
 import java.util.Set;
 import java.util.TreeSet;
+import java.util.stream.Collectors;
 import javax.annotation.PostConstruct;
 import javax.ejb.EJB;
 import javax.ejb.Stateless;
@@ -17,7 +18,6 @@
 import javax.persistence.EntityManager;
 import javax.persistence.NoResultException;
 import javax.persistence.PersistenceContext;
-import org.jboss.logging.Logger;
 
 /**
  * A bean providing the {@link ExplicitGroupProvider}s with container services,
@@ -115,15 +115,74 @@ public Set<ExplicitGroup> findAvailableFor( DvObject d ) {
     }
     
     /**
-     * Finds all the groups {@code ra} belongs to in the context of {@code o}. In effect,
+     * Finds all the explicit groups {@code ra} is a member of.
+     * @param ra the role assignee whose membership list we seek
+     * @return set of the explicit groups that contain {@code ra}.
+     */
+    public Set<ExplicitGroup> findGroups( RoleAssignee ra ) {
+        return findClosure(findDirectlyContainingGroups(ra));
+    }
+    
+    /**
+     * Finds all the explicit groups {@code ra} is <b>directly</b> a member of.
+     * To find all these groups and the groups the contain them (recursively upwards),
+     * consider using {@link #findGroups(edu.harvard.iq.dataverse.authorization.RoleAssignee)}
+     * @param ra the role assignee whose membership list we seek
+     * @return set of the explicit groups that contain {@code ra} directly.
+     * @see #findGroups(edu.harvard.iq.dataverse.authorization.RoleAssignee)
+     */
+    public Set<ExplicitGroup> findDirectlyContainingGroups( RoleAssignee ra ) {
+        if ( ra instanceof AuthenticatedUser ) {
+            return provider.updateProvider(
+                    new HashSet<>(
+                            em.createNamedQuery("ExplicitGroup.findByAuthenticatedUserIdentifier", ExplicitGroup.class)
+                              .setParameter("authenticatedUserIdentifier", ra.getIdentifier().substring(1))
+                              .getResultList()
+                  ));
+        } else if ( ra instanceof ExplicitGroup ) {
+            return provider.updateProvider(
+                    new HashSet<>(
+                            em.createNamedQuery("ExplicitGroup.findByContainedExplicitGroupId", ExplicitGroup.class)
+                              .setParameter("containedExplicitGroupId", ((ExplicitGroup) ra).getId())
+                              .getResultList()
+                  ));
+        } else {
+            return provider.updateProvider(
+                    new HashSet<>(
+                            em.createNamedQuery("ExplicitGroup.findByRoleAssgineeIdentifier", ExplicitGroup.class)
+                              .setParameter("roleAssigneeIdentifier", ra.getIdentifier())
+                              .getResultList()
+                  ));
+        }
+    }
+
+    /**
+     * Finds all the groups {@code ra} is a member of, in the context of {@code o}.
+     * This includes both direct and indirect memberships.
+     * @param ra The role assignee whose memberships we seek.
+     * @param o The {@link DvObject} whose context we search.
+     * @return All the groups in {@code o}'s context that {@code ra} is a member of.
+     */
+    public Set<ExplicitGroup> findGroups( RoleAssignee ra, DvObject o ) {
+        Set<ExplicitGroup> directGroups = findDirectGroups(ra, o);
+        Set<ExplicitGroup> closure = findClosure(directGroups);
+        return closure.stream()
+                .filter( g -> g.owner.isAncestorOf(o) )
+                .collect( Collectors.toSet() );
+    }
+    
+    /**
+     * Finds all the groups {@code ra} directly belongs to in the context of {@code o}. In effect,
      * collects all the groups {@code ra} belongs to and that are defined at {@code o}
-     * or one of its ancestors. Does not take group containment into account.
+     * or one of its ancestors.
+     * 
+     * <B>Does not take group containment into account.</B> Use
      * 
      * @param ra The role assignee that belongs to the groups
      * @param o the DvObject that defines the context of the search.
      * @return All the groups ra belongs to in the context of o.
      */
-    public Set<ExplicitGroup> findGroups( RoleAssignee ra, DvObject o ) {
+    public Set<ExplicitGroup> findDirectGroups( RoleAssignee ra, DvObject o ) {
         if ( o == null ) return Collections.emptySet();
         List<ExplicitGroup> groupList = new LinkedList<>();
         
@@ -155,4 +214,31 @@ public Set<ExplicitGroup> findGroups( RoleAssignee ra, DvObject o ) {
         return provider.updateProvider( new HashSet<>(groupList) );
     }
     
+    /**
+     * 
+     * Finds all the groups that contain the groups in {@code seed} (including {@code seed}), and the
+     * groups that contain these groups, an so on.
+     * 
+     * @param seed the initial set of groups.
+     * @return Transitive closure (based on group  containment) of the groups in {@code seed}.
+     */
+    protected Set<ExplicitGroup> findClosure( Set<ExplicitGroup> seed ) {
+        Set result = new HashSet<>();
+        
+        // The set of groups whose parents were not visited yet.
+        Set<ExplicitGroup> fringe = new HashSet<>(seed);
+        while ( ! fringe.isEmpty() ) {
+           ExplicitGroup g = fringe.iterator().next();
+           fringe.remove(g);
+           result.add(g);
+           
+           // add all of g's parents to the fringe, unless already visited.
+           findDirectlyContainingGroups(g).stream()
+                   .filter( eg -> !(result.contains(eg)||fringe.contains(eg) ))
+                   .forEach( fringe::add );
+        }
+
+        return result;
+    }
+    
 }
diff --git a/src/main/java/edu/harvard/iq/dataverse/authorization/groups/impl/ipaddress/IpGroup.java b/src/main/java/edu/harvard/iq/dataverse/authorization/groups/impl/ipaddress/IpGroup.java
index 56eb858a7d9..d6ee006bc52 100644
--- a/src/main/java/edu/harvard/iq/dataverse/authorization/groups/impl/ipaddress/IpGroup.java
+++ b/src/main/java/edu/harvard/iq/dataverse/authorization/groups/impl/ipaddress/IpGroup.java
@@ -8,7 +8,9 @@
 import edu.harvard.iq.dataverse.authorization.groups.impl.ipaddress.ip.IpAddress;
 import edu.harvard.iq.dataverse.authorization.groups.impl.ipaddress.ip.IpAddressRange;
 import edu.harvard.iq.dataverse.engine.command.DataverseRequest;
+import java.util.Collection;
 import java.util.HashSet;
+import java.util.Objects;
 import java.util.Set;
 import javax.persistence.CascadeType;
 import javax.persistence.Entity;
@@ -26,32 +28,31 @@
 @Entity
 public class IpGroup extends PersistedGlobalGroup {
     
-    @OneToMany(mappedBy = "owner", cascade=CascadeType.ALL)
+    @OneToMany(mappedBy = "owner", cascade=CascadeType.ALL, orphanRemoval = true)
     private Set<IPv6Range> ipv6Ranges;
 
-    @OneToMany(mappedBy = "owner", cascade=CascadeType.ALL)
+    @OneToMany(mappedBy = "owner", cascade=CascadeType.ALL, orphanRemoval = true)
     private Set<IPv4Range> ipv4Ranges;
     
     @Transient
     private IpGroupProvider provider;
     
-    public IpGroup() {
-        
-    }
+    public IpGroup() {}
     
     public IpGroup(IpGroupProvider provider) {
         this.provider = provider;
     }
     
     @Override
-    public boolean contains(DataverseRequest rq) {
+    public boolean contains( DataverseRequest rq ) {
         IpAddress addr = rq.getSourceAddress();
+        if ( addr == null ) return false;
+        
         for ( IpAddressRange r : ((addr instanceof IPv4Address) ? ipv4Ranges : ipv6Ranges) ) {
            Boolean containment =  r.contains(addr);
            if ( (containment != null) && containment ) {
                return true;
            }
-               
         }
         return false;
     }
@@ -79,9 +80,14 @@ public boolean isEditable() {
         return true;
     }
     
-    public void setProvider( IpGroupProvider prv ) {
+    public void setGroupProvider( IpGroupProvider prv ) {
         provider = prv;
     }
+    
+    @Override
+    public GroupProvider getGroupProvider() {
+        return provider;
+    }
 
     /**
      * Returns a <strong>read only</strong> set of all the ranges  in the group,
@@ -94,11 +100,6 @@ public Set<IpAddressRange> getRanges() {
         ranges.addAll( getIpv6Ranges() );
         return ranges;
     }
-    
-    @Override
-    public GroupProvider getGroupProvider() {
-        return provider;
-    }
 
     /**
      * Low-level JPA accessor
@@ -115,6 +116,7 @@ public Set<IPv6Range> getIpv6Ranges() {
      */
     public void setIpv6Ranges(Set<IPv6Range> ipv6Ranges) {
         this.ipv6Ranges = ipv6Ranges;
+        updateRangeOwnership(ipv6Ranges);
     }
     /**
      * Low-level JPA accessor
@@ -127,6 +129,37 @@ public Set<IPv4Range> getIpv4Ranges() {
 
     public void setIpv4Ranges(Set<IPv4Range> ipv4Ranges) {
         this.ipv4Ranges = ipv4Ranges;
+        updateRangeOwnership(ipv4Ranges);
+    }
+    
+    @Override
+    public boolean equals( Object o ) {
+        if ( o == null ) return false;
+        if ( o == this ) return true;
+        if ( ! (o instanceof IpGroup) ) return false;
+        
+        IpGroup other = (IpGroup) o;
+        
+        if ( ! Objects.equals(getId(), other.getId()) ) return false;
+        if ( ! Objects.equals(getDescription(), other.getDescription()) ) return false;
+        if ( ! Objects.equals(getDisplayName(), other.getDisplayName()) ) return false;
+        if ( ! Objects.equals(getPersistedGroupAlias(), other.getPersistedGroupAlias()) ) return false;
+        return getRanges().equals( other.getRanges() );
     }
 
+    @Override
+    public int hashCode() {
+        return getPersistedGroupAlias().hashCode();
+    }
+    
+    @Override
+    public String toString() {
+        return "[IpGroup alias:" + getPersistedGroupAlias() +" id:" + getId() + " ranges:" + getIpv4Ranges() + "," + getIpv6Ranges() + "]";
+    }
+    
+    private void updateRangeOwnership( Collection<? extends IpAddressRange> ranges ) {
+        for ( IpAddressRange rng : ranges ) {
+            rng.setOwner(this);
+        }
+    }
 }
diff --git a/src/main/java/edu/harvard/iq/dataverse/authorization/groups/impl/ipaddress/IpGroupProvider.java b/src/main/java/edu/harvard/iq/dataverse/authorization/groups/impl/ipaddress/IpGroupProvider.java
index efce422d5d6..7cf1b6818cb 100644
--- a/src/main/java/edu/harvard/iq/dataverse/authorization/groups/impl/ipaddress/IpGroupProvider.java
+++ b/src/main/java/edu/harvard/iq/dataverse/authorization/groups/impl/ipaddress/IpGroupProvider.java
@@ -3,12 +3,10 @@
 import edu.harvard.iq.dataverse.DvObject;
 import edu.harvard.iq.dataverse.authorization.RoleAssignee;
 import edu.harvard.iq.dataverse.authorization.groups.GroupProvider;
-import edu.harvard.iq.dataverse.authorization.users.User;
 import edu.harvard.iq.dataverse.engine.command.DataverseRequest;
 import java.util.Collections;
 import java.util.HashSet;
 import java.util.Set;
-import java.util.logging.Logger;
 
 /**
  * Creates {@link IpGroup}s.
@@ -16,8 +14,6 @@
  */
 public class IpGroupProvider implements GroupProvider<IpGroup> {
     
-    private static final Logger logger = Logger.getLogger(IpGroupProvider.class.getCanonicalName());
-
     private final IpGroupsServiceBean ipGroupsService;
     
     public IpGroupProvider(IpGroupsServiceBean ipGroupsService) {
@@ -63,23 +59,48 @@ public Set<IpGroup> findGlobalGroups() {
     }
     
     private IpGroup setProvider( IpGroup g ) {
-        g.setProvider(this);
+        if ( g != null ) {
+            g.setGroupProvider(this);
+        }
         return g;
     }
     
     private Set<IpGroup> updateProvider( Set<IpGroup> groups ) {
-        for ( IpGroup g : groups ) {
-            g.setProvider(this);
-        }
+        groups.forEach( g -> g.setGroupProvider(this) );
         return groups;
     }
     
     public IpGroup store(IpGroup grp) {
-        grp.setProvider(this);
-        return ipGroupsService.store(grp);
+        grp.setGroupProvider(this);
+        final IpGroup storedGroup = ipGroupsService.store(grp);
+        storedGroup.setGroupProvider(this); // The storage might un-set the provider, e.g. for when a group is updated.
+        return storedGroup;
     }
 
     public void deleteGroup(IpGroup grp) {
         ipGroupsService.deleteGroup(grp);
     }
+    
+    /**
+     * Finds an available name for an IP group. The name is based on the {@code base}
+     * parameter, but may be changed in case there's already a group with that name.
+     * 
+     * <strong>
+     * Note: This method might fail under very heavy loads. But we do not expect
+     * heavy creation of IP groups at this point.
+     * </strong>
+     *      
+     * @param base A base name.
+     * @return An available group name.
+     */
+    public String findAvailableName( String base ) {
+        if ( ipGroupsService.getByGroupName(base) == null ) {
+            return base;
+        }
+        int i=1;
+        while ( ipGroupsService.getByGroupName(base + "-" + i) != null ) {
+            i++;
+        }
+        return base + "-" + i;
+    }
 }
diff --git a/src/main/java/edu/harvard/iq/dataverse/authorization/groups/impl/ipaddress/IpGroupsServiceBean.java b/src/main/java/edu/harvard/iq/dataverse/authorization/groups/impl/ipaddress/IpGroupsServiceBean.java
index d135d97796e..b1380b552a4 100644
--- a/src/main/java/edu/harvard/iq/dataverse/authorization/groups/impl/ipaddress/IpGroupsServiceBean.java
+++ b/src/main/java/edu/harvard/iq/dataverse/authorization/groups/impl/ipaddress/IpGroupsServiceBean.java
@@ -38,6 +38,11 @@ public class IpGroupsServiceBean {
     @EJB
     RoleAssigneeServiceBean roleAssigneeSvc;
     
+    /**
+     * Stores (inserts/updates) the passed IP group.
+     * @param grp The group to store.
+     * @return Managed version of the group. The provider might be un-set.
+     */
     public IpGroup store( IpGroup grp ) {
         ActionLogRecord alr = new ActionLogRecord(ActionLogRecord.ActionType.GlobalGroups, "ipCreate");
         if ( grp.getGroupProvider() != null ) {
@@ -57,13 +62,12 @@ public IpGroup store( IpGroup grp ) {
                     return grp;
                     
                 } else {
-                    logger.log(Level.INFO, "Updating ip group {0}", grp.getPersistedGroupAlias());
                     existing.setDescription(grp.getDescription());
-                    existing.setDisplayName( grp.getDisplayName() );
-                    existing.setIpv4Ranges( grp.getIpv4Ranges() );
-                    existing.setIpv6Ranges( grp.getIpv6Ranges() );
+                    existing.setDisplayName(grp.getDisplayName());
+                    existing.setIpv4Ranges(grp.getIpv4Ranges());
+                    existing.setIpv6Ranges(grp.getIpv6Ranges());
                     actionLogSvc.log( alr.setActionSubType("ipUpdate") );
-                    return em.merge(existing);
+                    return existing;
                 }
             } else {
                 actionLogSvc.log( alr );
@@ -71,7 +75,7 @@ public IpGroup store( IpGroup grp ) {
                 return grp;
             }
         } else {
-             actionLogSvc.log( alr.setActionSubType("ipUpdate") );
+            actionLogSvc.log( alr.setActionSubType("ipUpdate") );
             return em.merge(grp);
         }
     }
@@ -98,7 +102,7 @@ public Set<IpGroup> findAllIncludingIp( IpAddress ipa ) {
         if ( ipa instanceof IPv4Address ) {
             IPv4Address ip4 = (IPv4Address) ipa;
             List<IpGroup> groupList = em.createNamedQuery("IPv4Range.findGroupsContainingAddressAsLong", IpGroup.class)
-                    .setParameter("addressAsLong", ip4.toLong()).getResultList();
+                    .setParameter("addressAsLong", ip4.toBigInteger()).getResultList();
             return new HashSet<>(groupList);
             
         } else if ( ipa instanceof IPv6Address ) {
diff --git a/src/main/java/edu/harvard/iq/dataverse/authorization/groups/impl/ipaddress/ip/IPv4Address.java b/src/main/java/edu/harvard/iq/dataverse/authorization/groups/impl/ipaddress/ip/IPv4Address.java
index e5255a19d7d..147ade9ddb1 100644
--- a/src/main/java/edu/harvard/iq/dataverse/authorization/groups/impl/ipaddress/ip/IPv4Address.java
+++ b/src/main/java/edu/harvard/iq/dataverse/authorization/groups/impl/ipaddress/ip/IPv4Address.java
@@ -1,5 +1,6 @@
 package edu.harvard.iq.dataverse.authorization.groups.impl.ipaddress.ip;
 
+import java.math.BigInteger;
 import java.util.Arrays;
 
 /**
@@ -33,6 +34,10 @@ public IPv4Address( int a, int b, int c, int d ) {
         this( new short[]{(short)a,(short)b,(short)c,(short)d} );
     }
     
+    public IPv4Address( BigInteger bits ) {
+        this( bits.longValue() );
+    }
+    
     public IPv4Address( long l ) {
         bytes[0] = (short)((l >>> 24) & 0xFF);
         bytes[1] = (short)((l >>> 16) & 0xFF);
@@ -59,7 +64,16 @@ public short[] getBytes() {
     }
     
     public long toLong() {
-        return (get(0)<<24) + (get(1)<<16) + (get(2)<<8) + get(3);
+        return (get(0)<<24) | (get(1)<<16) | (get(2)<<8) | get(3);
+    }
+    
+    public BigInteger toBigInteger() {
+        BigInteger res = BigInteger.ZERO;
+        for ( int i=0; i<3; i++ ) {
+            res = res.add(BigInteger.valueOf(get(i)))
+                     .shiftLeft(8);
+        }
+        return res.add(BigInteger.valueOf(get(3)));
     }
     
     @Override
diff --git a/src/main/java/edu/harvard/iq/dataverse/authorization/groups/impl/ipaddress/ip/IPv4Range.java b/src/main/java/edu/harvard/iq/dataverse/authorization/groups/impl/ipaddress/ip/IPv4Range.java
index 3b6348737ed..3ecd7689e1c 100644
--- a/src/main/java/edu/harvard/iq/dataverse/authorization/groups/impl/ipaddress/ip/IPv4Range.java
+++ b/src/main/java/edu/harvard/iq/dataverse/authorization/groups/impl/ipaddress/ip/IPv4Range.java
@@ -1,5 +1,6 @@
 package edu.harvard.iq.dataverse.authorization.groups.impl.ipaddress.ip;
 
+import java.math.BigInteger;
 import javax.persistence.Entity;
 import javax.persistence.GeneratedValue;
 import javax.persistence.Id;
@@ -31,16 +32,16 @@ public class IPv4Range extends IpAddressRange implements java.io.Serializable {
     Long id;
     
     /** The most significant bits of {@code this} range's top address, i.e the first two numbers of the IP address */
-    long topAsLong;
+    BigInteger topAsLong;
     
     /** The least significant bits, i.e the last tow numbers of the IP address */
-    long bottomAsLong;
+    BigInteger bottomAsLong;
     
     public IPv4Range(){}
     
     public IPv4Range(IPv4Address bottom, IPv4Address top) {
-        topAsLong = top.toLong();
-        bottomAsLong = bottom.toLong(); 
+        topAsLong = top.toBigInteger();
+        bottomAsLong = bottom.toBigInteger(); 
     }
     
     @Override
@@ -49,7 +50,7 @@ public IPv4Address getTop() {
     }
     
     public void setTop( IPv4Address aNewTop ) {
-        setTopAsLong( aNewTop.toLong() );
+        setTopAsLong( aNewTop.toBigInteger() );
     }
     
     @Override
@@ -58,27 +59,28 @@ public IPv4Address getBottom() {
     }
     
     public void setBottom( IPv4Address aNewBottom ) {
-        setTopAsLong( aNewBottom.toLong() );
+        setTopAsLong( aNewBottom.toBigInteger() );
     }
     
-    public long getTopAsLong() {
+    public BigInteger getTopAsLong() {
         return topAsLong;
     }
 
-    public void setTopAsLong(long topAsLong) {
+    public void setTopAsLong(BigInteger topAsLong) {
         this.topAsLong = topAsLong;
     }
 
-    public long getBottomAsLong() {
+    public BigInteger getBottomAsLong() {
         return bottomAsLong;
     }
 
-    public void setBottomAsLong(long bottomAsLong) {
+    public void setBottomAsLong(BigInteger bottomAsLong) {
         this.bottomAsLong = bottomAsLong;
     }
 
     @Override
     public Boolean contains(IpAddress anAddress) {
+        if ( anAddress == null ) return null;
         if ( anAddress instanceof IPv4Address ) {
             IPv4Address adr = (IPv4Address) anAddress;
             return getBottom().compareTo(adr)<=0 && getTop().compareTo(adr)>=0;
diff --git a/src/main/java/edu/harvard/iq/dataverse/authorization/groups/impl/ipaddress/ip/IPv6Range.java b/src/main/java/edu/harvard/iq/dataverse/authorization/groups/impl/ipaddress/ip/IPv6Range.java
index 5beaead8bd9..d1301d550c7 100644
--- a/src/main/java/edu/harvard/iq/dataverse/authorization/groups/impl/ipaddress/ip/IPv6Range.java
+++ b/src/main/java/edu/harvard/iq/dataverse/authorization/groups/impl/ipaddress/ip/IPv6Range.java
@@ -48,6 +48,7 @@ public IPv6Range() {}
     
     @Override
     public Boolean contains(IpAddress anAddress) {
+        if ( anAddress == null ) return null;
         if ( anAddress instanceof IPv6Address ) {
             IPv6Address adr = (IPv6Address) anAddress;
             return getBottom().compareTo(adr)<=0 && getTop().compareTo(adr)>=0;
diff --git a/src/main/java/edu/harvard/iq/dataverse/authorization/groups/impl/ipaddress/ip/IpAddressRange.java b/src/main/java/edu/harvard/iq/dataverse/authorization/groups/impl/ipaddress/ip/IpAddressRange.java
index c2d1029b44d..5c6c9d548a4 100644
--- a/src/main/java/edu/harvard/iq/dataverse/authorization/groups/impl/ipaddress/ip/IpAddressRange.java
+++ b/src/main/java/edu/harvard/iq/dataverse/authorization/groups/impl/ipaddress/ip/IpAddressRange.java
@@ -63,6 +63,10 @@ public boolean equals(Object obj) {
                 && Objects.equals(this.getTop(), other.getTop());
     }
 
+    public boolean isSingleAddress() {
+        return getTop().equals(getBottom());
+    }
+    
     @Override
     public String toString() {
         return "[IpAddressRange " + getTop() + "-" + getBottom() + ']';
diff --git a/src/main/java/edu/harvard/iq/dataverse/authorization/users/AuthenticatedUser.java b/src/main/java/edu/harvard/iq/dataverse/authorization/users/AuthenticatedUser.java
index fdeab33f220..646605831b3 100644
--- a/src/main/java/edu/harvard/iq/dataverse/authorization/users/AuthenticatedUser.java
+++ b/src/main/java/edu/harvard/iq/dataverse/authorization/users/AuthenticatedUser.java
@@ -256,6 +256,10 @@ public void setShibIdentityProvider(String shibIdentityProvider) {
     }
     
     @Override
+    public String toString() {
+        return "[AuthenticatedUser identifier:" + getIdentifier() + "]";
+    }
+    
     public String getSortByString() {
         return this.getLastName() + " " + this.getFirstName() + " " + this.getUserIdentifier();
     }
diff --git a/src/main/java/edu/harvard/iq/dataverse/authorization/users/GuestUser.java b/src/main/java/edu/harvard/iq/dataverse/authorization/users/GuestUser.java
index 45177beace5..b2fd3194f70 100644
--- a/src/main/java/edu/harvard/iq/dataverse/authorization/users/GuestUser.java
+++ b/src/main/java/edu/harvard/iq/dataverse/authorization/users/GuestUser.java
@@ -42,7 +42,12 @@ public boolean isSuperuser() {
     public boolean equals( Object o ) {
         return (o instanceof GuestUser);
     }
-
+    
+    @Override
+    public String toString() {
+        return "[GuestUser :guest]";
+    }
+    
     @Override
     public int hashCode() {
         return 7;
diff --git a/src/main/java/edu/harvard/iq/dataverse/engine/command/DataverseRequest.java b/src/main/java/edu/harvard/iq/dataverse/engine/command/DataverseRequest.java
index f1c628ae0f3..e1d5a34d5f5 100644
--- a/src/main/java/edu/harvard/iq/dataverse/engine/command/DataverseRequest.java
+++ b/src/main/java/edu/harvard/iq/dataverse/engine/command/DataverseRequest.java
@@ -1,9 +1,8 @@
 package edu.harvard.iq.dataverse.engine.command;
 
 import edu.harvard.iq.dataverse.authorization.groups.impl.ipaddress.ip.IpAddress;
+import edu.harvard.iq.dataverse.authorization.users.AuthenticatedUser;
 import edu.harvard.iq.dataverse.authorization.users.User;
-import java.util.logging.Level;
-import java.util.logging.Logger;
 import javax.servlet.http.HttpServletRequest;
 
 /**
@@ -17,52 +16,19 @@ public class DataverseRequest {
     
     private final User user;
     private final IpAddress sourceAddress;
-    private static final Logger logger = Logger.getLogger(DataverseRequest.class.getCanonicalName());
     
     public DataverseRequest(User aUser, HttpServletRequest aHttpServletRequest) {
         this.user = aUser;
-        String remoteAddressStr = null;
-        
-        try {
-            remoteAddressStr = aHttpServletRequest.getRemoteAddr();
-        } catch (Exception _npe) {}
-        
-        /*
-            It was reported earlier, that HttpServletRequest.getRemoteAddr() does 
-            not supply the correct address of the incoming request, when Glassfish 
-            is running behind the Apache proxy. This is NOT true - can be easily 
-            confirmed with the log message below (will be switched to .fine when 
-            released). When this constructor is called by the ApiBlockingFileter, 
-            the remoteAddressStr will correctly show the remote address; whether
-            we are behind a proxy, or not.
-            As of now (4.2.3), this is the ONLY situation where we check the remote
-            IP address for the purposes of Authentication/Authorization. 
-        
-            HOWEVER, this log message below consistently shows NULL when non-API,  
-            page requests are coming in. This is true BOTH with or without the proxy. 
-            So this must mean that when the DataverseRequest object is created 
-            somewhere outside the ApiBlockingFilter, it likely doesn't get the 
-            HttpServletRequest object properly passed to the constructor. 
-            Which further means that in order to enable IP groups, we'll have 
-            to fix that, and make sure the IP address is properly set for such 
-            requests. 
-        
-            But, once again, as of now this sourceAddress is only being used for 
-            determining if an API request is coming from localhost. 
-        
-            (It appears that for all the regular page requests, the DataverseRequest
-            object gets created in DataverseRequestServiceBean.java, like this: 
-                dataverseRequest = new DataverseRequest(dataverseSessionSvc.getUser(), httpRequest);
-            with the httpRequest supplied by the @Context... why this isn't working
-            properly - I don't know)
-    
-            -- L.A. 4.2.3
-        */
-        
-        logger.fine("DataverseRequest: Obtained remote address: "+remoteAddressStr);
-        
-        if ( remoteAddressStr == null ) {
-            remoteAddressStr = "0.0.0.0";
+
+        final String undefined = "0.0.0.0";
+        String saneDefault = undefined;
+        String remoteAddressStr = saneDefault;
+
+        if (aHttpServletRequest != null) {
+            String remoteAddressFromRequest = aHttpServletRequest.getRemoteAddr();
+            if (remoteAddressFromRequest != null) {
+                remoteAddressStr = remoteAddressFromRequest;
+            }
         }
         sourceAddress = IpAddress.valueOf( remoteAddressStr );
     }
@@ -83,12 +49,23 @@ public IpAddress getSourceAddress() {
         return sourceAddress;
     }
 
-    
     @Override
     public String toString() {
-        return "[DataverseRequest user:" + getUser() + "@" + getSourceAddress() + "]";
-                
+        return "[DataverseRequest user:" + getUser() + "@" + getSourceAddress() + "]";                
     }
     
+    /**
+     * Get an AuthenticatedUser or return null
+     * @return 
+     */
+    public AuthenticatedUser getAuthenticatedUser(){
+        
+        User authUser = this.getUser();
+        
+        if (authUser instanceof AuthenticatedUser){
+            return (AuthenticatedUser)authUser;
+        }
+        return null;
+    }
     
 }
diff --git a/src/main/java/edu/harvard/iq/dataverse/mydata/DataRetrieverAPI.java b/src/main/java/edu/harvard/iq/dataverse/mydata/DataRetrieverAPI.java
index 3744a90241a..73a413ecef4 100644
--- a/src/main/java/edu/harvard/iq/dataverse/mydata/DataRetrieverAPI.java
+++ b/src/main/java/edu/harvard/iq/dataverse/mydata/DataRetrieverAPI.java
@@ -16,9 +16,10 @@
 import edu.harvard.iq.dataverse.authorization.AuthenticationServiceBean;
 import edu.harvard.iq.dataverse.authorization.DataverseRole;
 import edu.harvard.iq.dataverse.authorization.DataverseRolePermissionHelper;
-import edu.harvard.iq.dataverse.authorization.MyDataQueryHelperServiceBean;
+//import edu.harvard.iq.dataverse.authorization.MyDataQueryHelperServiceBean;
 import edu.harvard.iq.dataverse.authorization.groups.GroupServiceBean;
 import edu.harvard.iq.dataverse.authorization.users.AuthenticatedUser;
+import edu.harvard.iq.dataverse.engine.command.DataverseRequest;
 import edu.harvard.iq.dataverse.search.SearchConstants;
 import edu.harvard.iq.dataverse.search.SearchException;
 import edu.harvard.iq.dataverse.search.SearchFields;
@@ -68,8 +69,8 @@ public class DataRetrieverAPI extends AbstractApiBean {
     SearchServiceBean searchService;
     @EJB
     AuthenticationServiceBean authenticationService;
-    @EJB
-    MyDataQueryHelperServiceBean myDataQueryHelperServiceBean;
+    //@EJB
+    //MyDataQueryHelperServiceBean myDataQueryHelperServiceBean;
     @EJB
     GroupServiceBean groupService;
     
@@ -165,9 +166,9 @@ private AuthenticatedUser getUserFromIdentifier(String userIdentifier){
         return authenticationService.getAuthenticatedUser(userIdentifier);
     }
     
-    public Map<String, Long> getTotalCountsFromSolrAsJavaMap(AuthenticatedUser searchUser, MyDataFinder myDataFinder ){
+    public Map<String, Long> getTotalCountsFromSolrAsJavaMap(DataverseRequest dataverseRequest, MyDataFinder myDataFinder ){
         //msgt("getTotalCountsFromSolrAsJavaMap: " + searchUser.getIdentifier());
-        SolrQueryResponse solrQueryResponseForCounts = getTotalCountsFromSolr(searchUser, myDataFinder);
+        SolrQueryResponse solrQueryResponseForCounts = getTotalCountsFromSolr(dataverseRequest, myDataFinder);
         if (solrQueryResponseForCounts == null){
             logger.severe("DataRetrieverAPI.getTotalCountsFromSolrAsJSON: solrQueryResponseForCounts should not be null");
             return null;
@@ -175,9 +176,9 @@ public Map<String, Long> getTotalCountsFromSolrAsJavaMap(AuthenticatedUser searc
         return solrQueryResponseForCounts.getDvObjectCounts();
     }
     
-    public JsonObjectBuilder getTotalCountsFromSolrAsJSON(AuthenticatedUser searchUser, MyDataFinder myDataFinder ){
+    public JsonObjectBuilder getTotalCountsFromSolrAsJSON(DataverseRequest dataverseRequest, MyDataFinder myDataFinder ){
     
-        SolrQueryResponse solrQueryResponseForCounts = getTotalCountsFromSolr(searchUser, myDataFinder);
+        SolrQueryResponse solrQueryResponseForCounts = getTotalCountsFromSolr(dataverseRequest, myDataFinder);
         if (solrQueryResponseForCounts == null){
             logger.severe("DataRetrieverAPI.getTotalCountsFromSolrAsJSON: solrQueryResponseForCounts should not be null");
             return null;
@@ -186,20 +187,20 @@ public JsonObjectBuilder getTotalCountsFromSolrAsJSON(AuthenticatedUser searchUs
     }
     
     
-    private SolrQueryResponse getTotalCountsFromSolr(AuthenticatedUser searchUser, MyDataFinder myDataFinder){
+    private SolrQueryResponse getTotalCountsFromSolr(DataverseRequest dataverseRequest, MyDataFinder myDataFinder){
         //msgt("getTotalCountsFromSolr: " + searchUser.getIdentifier());
 
         if (myDataFinder == null){
             throw new NullPointerException("myDataFinder cannot be null");
         }
-        if (searchUser == null){
-            throw new NullPointerException("searchUser cannot be null");
+        if (dataverseRequest == null){
+            throw new NullPointerException("dataverseRequest cannot be null");
         }
         
         // -------------------------------------------------------
         // Create new filter params that only check by the User 
         // -------------------------------------------------------
-        MyDataFilterParams filterParams = new MyDataFilterParams(searchUser, myDataFinder.getRolePermissionHelper());
+        MyDataFilterParams filterParams = new MyDataFilterParams(dataverseRequest, myDataFinder.getRolePermissionHelper());
         if (filterParams.hasError()){
             logger.severe("getTotalCountsFromSolr. filterParams error: " + filterParams.getErrorMessage());           
             return null;
@@ -232,7 +233,7 @@ private SolrQueryResponse getTotalCountsFromSolr(AuthenticatedUser searchUser, M
         SolrQueryResponse solrQueryResponseForCounts;
         try {
             solrQueryResponseForCounts = searchService.search(
-                    searchUser, //
+                    dataverseRequest,
                     null, // subtree, default it to Dataverse for now
                     "*",  //    Get everything--always
                     filterQueries,//filterQueries,
@@ -288,7 +289,6 @@ public String retrieveMyDataAsJsonString(@QueryParam("dvobject_types") List<Stri
         // For, superusers, the searchUser may differ from the authUser
         //
         AuthenticatedUser searchUser = null;  
-        
 
         if (DEBUG_MODE==true){      // DEBUG: use userIdentifier
             authUser = getUserFromIdentifier(userIdentifier);
@@ -351,7 +351,10 @@ public String retrieveMyDataAsJsonString(@QueryParam("dvobject_types") List<Stri
         // ---------------------------------
         // (1) Initialize filterParams and check for Errors 
         // ---------------------------------
-        MyDataFilterParams filterParams = new MyDataFilterParams(authUser, dtypes, pub_states, roleIds, searchTerm);
+        DataverseRequest dataverseRequest = createDataverseRequest(authUser);
+
+        
+        MyDataFilterParams filterParams = new MyDataFilterParams(dataverseRequest, dtypes, pub_states, roleIds, searchTerm);
         if (filterParams.hasError()){
             return this.getJSONErrorString(filterParams.getErrorMessage(), filterParams.getErrorMessage());
         }
@@ -397,7 +400,7 @@ public String retrieveMyDataAsJsonString(@QueryParam("dvobject_types") List<Stri
 
         try {
                 solrQueryResponse = searchService.search(
-                        searchUser, // 
+                        dataverseRequest,
                         null, // subtree, default it to Dataverse for now
                         filterParams.getSearchTerm(),  //"*", //
                         filterQueries,//filterQueries,
@@ -441,7 +444,7 @@ public String retrieveMyDataAsJsonString(@QueryParam("dvobject_types") List<Stri
                                 paginationStart);
         
         RoleTagRetriever roleTagRetriever = new RoleTagRetriever(this.rolePermissionHelper, this.roleAssigneeSvc, this.dvObjectServiceBean);
-        roleTagRetriever.loadRoles(searchUser, solrQueryResponse);
+        roleTagRetriever.loadRoles(dataverseRequest, solrQueryResponse);
 
                 
         jsonData.add(DataRetrieverAPI.JSON_SUCCESS_FIELD_NAME, true)
diff --git a/src/main/java/edu/harvard/iq/dataverse/mydata/MyDataFilterParams.java b/src/main/java/edu/harvard/iq/dataverse/mydata/MyDataFilterParams.java
index 3b8fc4f1720..b10a37aff5d 100644
--- a/src/main/java/edu/harvard/iq/dataverse/mydata/MyDataFilterParams.java
+++ b/src/main/java/edu/harvard/iq/dataverse/mydata/MyDataFilterParams.java
@@ -11,6 +11,7 @@
 import edu.harvard.iq.dataverse.search.IndexServiceBean;
 import edu.harvard.iq.dataverse.authorization.DataverseRolePermissionHelper;
 import edu.harvard.iq.dataverse.authorization.users.AuthenticatedUser;
+import edu.harvard.iq.dataverse.engine.command.DataverseRequest;
 import edu.harvard.iq.dataverse.search.SearchConstants;
 import edu.harvard.iq.dataverse.search.SearchFields;
 import java.util.ArrayList;
@@ -74,6 +75,7 @@ public class MyDataFilterParams {
     // -----------------------------------
     // Filter parameters
     // -----------------------------------
+    private DataverseRequest dataverseRequest;
     private AuthenticatedUser authenticatedUser;
     private String userIdentifier;
     private List<String> dvObjectTypes;    
@@ -99,14 +101,15 @@ public class MyDataFilterParams {
      * @param authenticatedUser
      * @param userIdentifier 
      */
-    public MyDataFilterParams(AuthenticatedUser authenticatedUser, DataverseRolePermissionHelper roleHelper){
-        if (authenticatedUser==null){
-            throw new NullPointerException("MyDataFilterParams constructor: authenticatedIUser cannot be null ");
+    public MyDataFilterParams(DataverseRequest dataverseRequest, DataverseRolePermissionHelper roleHelper){
+        if (dataverseRequest==null){
+            throw new NullPointerException("MyDataFilterParams constructor: dataverseRequest cannot be null ");
         }
-        this.authenticatedUser = authenticatedUser;
+        this.dataverseRequest = dataverseRequest;
+        this.setAuthenticatedUserFromDataverseRequest(dataverseRequest);
         this.userIdentifier = authenticatedUser.getIdentifier();
 
-         if (roleHelper==null){
+        if (roleHelper==null){
             throw new NullPointerException("MyDataFilterParams constructor: roleHelper cannot be null");
         }
         this.dvObjectTypes = MyDataFilterParams.allDvObjectTypes;
@@ -121,11 +124,12 @@ public MyDataFilterParams(AuthenticatedUser authenticatedUser, DataverseRolePerm
      * @param publicationStatuses 
      * @param searchTerm 
      */    
-    public MyDataFilterParams(AuthenticatedUser authenticatedUser, List<String> dvObjectTypes, List<String> publicationStatuses, List<Long> roleIds, String searchTerm){
-        if (authenticatedUser==null){
-            throw new NullPointerException("MyDataFilterParams constructor: authenticatedIUser cannot be null ");
+    public MyDataFilterParams(DataverseRequest dataverseRequest, List<String> dvObjectTypes, List<String> publicationStatuses, List<Long> roleIds, String searchTerm){
+        if (dataverseRequest==null){
+            throw new NullPointerException("MyDataFilterParams constructor: dataverseRequest cannot be null ");
         }
-        this.authenticatedUser = authenticatedUser;
+        this.dataverseRequest = dataverseRequest;
+        this.setAuthenticatedUserFromDataverseRequest(dataverseRequest);
         this.userIdentifier = authenticatedUser.getIdentifier();
 
         if (dvObjectTypes==null){
@@ -153,6 +157,20 @@ public MyDataFilterParams(AuthenticatedUser authenticatedUser, List<String> dvOb
     }
     
     
+    private void setAuthenticatedUserFromDataverseRequest(DataverseRequest dvRequest){
+        
+        if (dvRequest == null){
+            throw new NullPointerException("MyDataFilterParams getAuthenticatedUserFromDataverseRequest: dvRequest cannot be null");
+        }
+        
+        this.authenticatedUser = dvRequest.getAuthenticatedUser();
+        
+        if (this.authenticatedUser == null){
+            throw new NullPointerException("MyDataFilterParams getAuthenticatedUserFromDataverseRequest: Hold on! dvRequest must be associated with an AuthenticatedUser be null");
+        }
+    }  
+    
+    
     public List<Long> getRoleIds(){
         
         return this.roleIds;
@@ -344,5 +362,8 @@ public static List<String[]> getPublishedStatesForMyDataPage(){
         return publicationStateInfoList;
     }
   
+    public DataverseRequest getDataverseRequest(){
+        return this.dataverseRequest;
+    }
   
 }
diff --git a/src/main/java/edu/harvard/iq/dataverse/mydata/MyDataFinder.java b/src/main/java/edu/harvard/iq/dataverse/mydata/MyDataFinder.java
index 548878f5814..7cbd5572550 100644
--- a/src/main/java/edu/harvard/iq/dataverse/mydata/MyDataFinder.java
+++ b/src/main/java/edu/harvard/iq/dataverse/mydata/MyDataFinder.java
@@ -446,10 +446,9 @@ public JsonArrayBuilder getListofSelectedRoles(){
     
     private boolean runStep1RoleAssignments(){
                 
-        List<Object[]> results = this.roleAssigneeService.getAssigneeAndRoleIdListFor(filterParams.getAuthenticatedUser()
-                                        , this.filterParams.getRoleIds());
+        List<Object[]> results = this.roleAssigneeService.getAssigneeAndRoleIdListFor(filterParams);
         
-        //msgt("runStep1RoleAssignments results: " + results.toString());
+        System.out.println("runStep1RoleAssignments results: " + results.toString());
 
         if (results == null){
             this.addErrorMessage("Sorry, the EntityManager isn't working (still).");
@@ -474,6 +473,8 @@ private boolean runStep1RoleAssignments(){
             Long dvId = (Long)ra[0];
             Long roleId = (Long)ra[1];
             
+            
+            
             //----------------------------------
             // Is this is a harvested Dataverse?
             // If so, skip it.
diff --git a/src/main/java/edu/harvard/iq/dataverse/mydata/MyDataPage.java b/src/main/java/edu/harvard/iq/dataverse/mydata/MyDataPage.java
index 3a6979cca89..2cce3b06d82 100644
--- a/src/main/java/edu/harvard/iq/dataverse/mydata/MyDataPage.java
+++ b/src/main/java/edu/harvard/iq/dataverse/mydata/MyDataPage.java
@@ -16,15 +16,17 @@
 import edu.harvard.iq.dataverse.search.SolrQueryResponse;
 import edu.harvard.iq.dataverse.authorization.DataverseRole;
 import edu.harvard.iq.dataverse.authorization.DataverseRolePermissionHelper;
-import edu.harvard.iq.dataverse.authorization.MyDataQueryHelperServiceBean;
 import edu.harvard.iq.dataverse.authorization.users.AuthenticatedUser;
+import edu.harvard.iq.dataverse.engine.command.DataverseRequest;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.logging.Logger;
 import javax.ejb.EJB;
+import javax.faces.context.FacesContext;
 import javax.faces.view.ViewScoped;
 import javax.inject.Inject;
 import javax.inject.Named;
+import javax.servlet.http.HttpServletRequest;
 
 /*
  * To change this license header, choose License Headers in Project Properties.
@@ -52,8 +54,8 @@ public class MyDataPage implements java.io.Serializable {
     DvObjectServiceBean dvObjectServiceBean;
     @EJB
     SearchServiceBean searchService;
-    @EJB
-    MyDataQueryHelperServiceBean myDataQueryHelperServiceBean;
+//    @EJB
+//    MyDataQueryHelperServiceBean myDataQueryHelperServiceBean;
     @Inject
     PermissionsWrapper permissionsWrapper;
     
@@ -165,12 +167,15 @@ public String init() {
 
         // Initialize a filterParams object to buid the Publication Status checkboxes
         //
-        this.filterParams = new MyDataFilterParams(authUser,  MyDataFilterParams.defaultDvObjectTypes, null, null, null);
+        HttpServletRequest httpServletRequest = (HttpServletRequest) FacesContext.getCurrentInstance().getExternalContext().getRequest();
+
+        DataverseRequest dataverseRequest = new DataverseRequest(authUser, httpServletRequest);
+        this.filterParams = new MyDataFilterParams(dataverseRequest,  MyDataFilterParams.defaultDvObjectTypes, null, null, null);
         
         
         // Temp DataverseRolePermissionHelper -- not in its normal role but for creating initial checkboxes
         //
-        rolePermissionHelper = new DataverseRolePermissionHelper(getRolesUsedToCreateCheckboxes(authUser));
+        rolePermissionHelper = new DataverseRolePermissionHelper(getRolesUsedToCreateCheckboxes(dataverseRequest));
        
         //this.setUserCountTotals(authUser, rolePermissionHelper);
         return null;
@@ -183,10 +188,10 @@ public String getAuthUserIdentifier(){
         return MyDataUtil.formatUserIdentifierForMyDataForm(this.authUser.getIdentifier());
     }
     
-    private List<DataverseRole> getRolesUsedToCreateCheckboxes(AuthenticatedUser authUser){
+    private List<DataverseRole> getRolesUsedToCreateCheckboxes(DataverseRequest dataverseRequest){
 
-        if (authUser==null){
-            throw new NullPointerException("authUser cannot be null");
+        if (dataverseRequest==null){
+            throw new NullPointerException("dataverseRequest cannot be null");
         }
         // Initialize the role checboxes
         //
@@ -198,7 +203,7 @@ private List<DataverseRole> getRolesUsedToCreateCheckboxes(AuthenticatedUser aut
             roleList = dataverseRoleService.findAll();
         }else{
             // (2) For a regular users
-            roleList = roleAssigneeService.getAssigneeDataverseRoleFor(authUser);
+            roleList = roleAssigneeService.getAssigneeDataverseRoleFor(dataverseRequest);
         
             // If there are no assigned roles, show them all?
             // This may not make sense
diff --git a/src/main/java/edu/harvard/iq/dataverse/mydata/RoleTagRetriever.java b/src/main/java/edu/harvard/iq/dataverse/mydata/RoleTagRetriever.java
index 17477dda014..037a5ebc9bd 100644
--- a/src/main/java/edu/harvard/iq/dataverse/mydata/RoleTagRetriever.java
+++ b/src/main/java/edu/harvard/iq/dataverse/mydata/RoleTagRetriever.java
@@ -12,6 +12,7 @@
 import edu.harvard.iq.dataverse.search.SolrSearchResult;
 import edu.harvard.iq.dataverse.authorization.DataverseRolePermissionHelper;
 import edu.harvard.iq.dataverse.authorization.users.AuthenticatedUser;
+import edu.harvard.iq.dataverse.engine.command.DataverseRequest;
 import edu.harvard.iq.dataverse.search.SearchConstants;
 import java.util.ArrayList;
 import java.util.Collections;
@@ -69,7 +70,12 @@ public RoleTagRetriever(DataverseRolePermissionHelper rolePermissionHelper
        this.dvObjectServiceBean = dvObjectServiceBean;
     }
     
-    public void loadRoles(AuthenticatedUser au , SolrQueryResponse solrQueryResponse){
+    public void loadRoles(DataverseRequest dataverseRequest , SolrQueryResponse solrQueryResponse){
+        if (dataverseRequest == null){
+            throw new NullPointerException("RoleTagRetriever.constructor. dataverseRequest cannot be null");
+        }
+        
+        AuthenticatedUser au = dataverseRequest.getAuthenticatedUser();
         
         if (au == null){
             throw new NullPointerException("RoleTagRetriever.constructor. au cannot be null");
@@ -94,7 +100,7 @@ public void loadRoles(AuthenticatedUser au , SolrQueryResponse solrQueryResponse
         findDataverseIdsForFiles();
         
         // (4) Retrieve the role ids
-        retrieveRoleIdsForDvObjects(au);
+        retrieveRoleIdsForDvObjects(dataverseRequest, au);
 
         // (5) Prepare final role lists
         prepareFinalRoleLists();
@@ -349,7 +355,7 @@ private void findDataverseIdsForFiles(){
     }
     
     
-    private boolean retrieveRoleIdsForDvObjects(AuthenticatedUser au ){
+    private boolean retrieveRoleIdsForDvObjects(DataverseRequest dataverseRequest, AuthenticatedUser au){
         
         String userIdentifier = au.getUserIdentifier();
         if (userIdentifier == null){
@@ -366,7 +372,7 @@ private boolean retrieveRoleIdsForDvObjects(AuthenticatedUser au ){
         }
         //msg("dvObjectIdList: " + dvObjectIdList.toString());
 
-        List<Object[]> results = this.roleAssigneeService.getRoleIdsFor(au, dvObjectIdList);
+        List<Object[]> results = this.roleAssigneeService.getRoleIdsFor(dataverseRequest, dvObjectIdList);
         
         //msgt("runStep1RoleAssignments results: " + results.toString());
 
diff --git a/src/main/java/edu/harvard/iq/dataverse/search/SearchFilesServiceBean.java b/src/main/java/edu/harvard/iq/dataverse/search/SearchFilesServiceBean.java
index d32dbe4dfa6..60f35f39159 100644
--- a/src/main/java/edu/harvard/iq/dataverse/search/SearchFilesServiceBean.java
+++ b/src/main/java/edu/harvard/iq/dataverse/search/SearchFilesServiceBean.java
@@ -3,12 +3,15 @@
 import edu.harvard.iq.dataverse.DatasetVersion;
 import edu.harvard.iq.dataverse.Dataverse;
 import edu.harvard.iq.dataverse.authorization.users.User;
+import edu.harvard.iq.dataverse.engine.command.DataverseRequest;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.logging.Logger;
 import javax.ejb.EJB;
 import javax.ejb.Stateless;
+import javax.faces.context.FacesContext;
 import javax.inject.Named;
+import javax.servlet.http.HttpServletRequest;
 
 @Named
 @Stateless
@@ -40,7 +43,8 @@ public FileView getFileView(DatasetVersion datasetVersion, User user, String use
         int numResultsPerPage = 25;
         SolrQueryResponse solrQueryResponse = null;
         try {
-            solrQueryResponse = searchService.search(user, dataverse, finalQuery, filterQueries, sortField, sortOrder, paginationStart, onlyDataRelatedToMe, numResultsPerPage);
+            HttpServletRequest httpServletRequest = (HttpServletRequest) FacesContext.getCurrentInstance().getExternalContext().getRequest();
+            solrQueryResponse = searchService.search(new DataverseRequest(user, httpServletRequest), dataverse, finalQuery, filterQueries, sortField, sortOrder, paginationStart, onlyDataRelatedToMe, numResultsPerPage);
         } catch (SearchException ex) {
             logger.info(SearchException.class + " searching for files: " + ex);
             return null;
diff --git a/src/main/java/edu/harvard/iq/dataverse/search/SearchIncludeFragment.java b/src/main/java/edu/harvard/iq/dataverse/search/SearchIncludeFragment.java
index 8eab46a3556..7f0cd51cad4 100644
--- a/src/main/java/edu/harvard/iq/dataverse/search/SearchIncludeFragment.java
+++ b/src/main/java/edu/harvard/iq/dataverse/search/SearchIncludeFragment.java
@@ -16,6 +16,7 @@
 import edu.harvard.iq.dataverse.SettingsWrapper;
 import edu.harvard.iq.dataverse.WidgetWrapper;
 import edu.harvard.iq.dataverse.dataaccess.ImageThumbConverter;
+import edu.harvard.iq.dataverse.engine.command.DataverseRequest;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Date;
@@ -26,9 +27,11 @@
 import java.util.Set;
 import java.util.logging.Logger;
 import javax.ejb.EJB;
+import javax.faces.context.FacesContext;
 import javax.faces.view.ViewScoped;
 import javax.inject.Inject;
 import javax.inject.Named;
+import javax.servlet.http.HttpServletRequest;
 import org.apache.commons.lang.StringUtils;
 
 @ViewScoped
@@ -307,10 +310,12 @@ public void search(boolean onlyDataRelatedToMe) {
              * https://github.com/IQSS/dataverse/issues/84
              */
             int numRows = 10;
-            solrQueryResponse = searchService.search(session.getUser(), dataverse, queryToPassToSolr, filterQueriesFinal, sortField, sortOrder.toString(), paginationStart, onlyDataRelatedToMe, numRows, false);
+            HttpServletRequest httpServletRequest = (HttpServletRequest) FacesContext.getCurrentInstance().getExternalContext().getRequest();
+            DataverseRequest dataverseRequest = new DataverseRequest(session.getUser(), httpServletRequest);
+            solrQueryResponse = searchService.search(dataverseRequest, dataverse, queryToPassToSolr, filterQueriesFinal, sortField, sortOrder.toString(), paginationStart, onlyDataRelatedToMe, numRows, false);
             // This 2nd search() is for populating the facets: -- L.A. 
             // TODO: ...
-            solrQueryResponseAllTypes = searchService.search(session.getUser(), dataverse, queryToPassToSolr, filterQueriesFinalAllTypes, sortField, sortOrder.toString(), paginationStart, onlyDataRelatedToMe, numRows, false);
+            solrQueryResponseAllTypes = searchService.search(dataverseRequest, dataverse, queryToPassToSolr, filterQueriesFinalAllTypes, sortField, sortOrder.toString(), paginationStart, onlyDataRelatedToMe, numRows, false);
         } catch (SearchException ex) {
             Throwable cause = ex;
             StringBuilder sb = new StringBuilder();
diff --git a/src/main/java/edu/harvard/iq/dataverse/search/SearchServiceBean.java b/src/main/java/edu/harvard/iq/dataverse/search/SearchServiceBean.java
index 54c06214383..fc7644dfdd1 100644
--- a/src/main/java/edu/harvard/iq/dataverse/search/SearchServiceBean.java
+++ b/src/main/java/edu/harvard/iq/dataverse/search/SearchServiceBean.java
@@ -9,7 +9,6 @@
 import edu.harvard.iq.dataverse.Dataverse;
 import edu.harvard.iq.dataverse.DataverseFacet;
 import edu.harvard.iq.dataverse.DataverseServiceBean;
-import edu.harvard.iq.dataverse.DvObject;
 import edu.harvard.iq.dataverse.DvObjectServiceBean;
 import edu.harvard.iq.dataverse.authorization.groups.Group;
 import edu.harvard.iq.dataverse.authorization.groups.GroupServiceBean;
@@ -17,6 +16,7 @@
 import edu.harvard.iq.dataverse.authorization.users.PrivateUrlUser;
 import edu.harvard.iq.dataverse.authorization.users.GuestUser;
 import edu.harvard.iq.dataverse.authorization.users.User;
+import edu.harvard.iq.dataverse.engine.command.DataverseRequest;
 import edu.harvard.iq.dataverse.util.JsfHelper;
 import edu.harvard.iq.dataverse.util.SystemConfig;
 import java.lang.reflect.Field;
@@ -108,7 +108,7 @@ public void close(){
      * related to permissions
      *
      *
-     * @param user
+     * @param dataverseRequest
      * @param dataverse
      * @param query
      * @param filterQueries
@@ -120,8 +120,8 @@ public void close(){
      * @return
      * @throws SearchException
      */
-    public SolrQueryResponse search(User user, Dataverse dataverse, String query, List<String> filterQueries, String sortField, String sortOrder, int paginationStart, boolean onlyDatatRelatedToMe, int numResultsPerPage) throws SearchException {
-        return search(user, dataverse, query, filterQueries, sortField, sortOrder, paginationStart, onlyDatatRelatedToMe, numResultsPerPage, true);
+    public SolrQueryResponse search(DataverseRequest dataverseRequest, Dataverse dataverse, String query, List<String> filterQueries, String sortField, String sortOrder, int paginationStart, boolean onlyDatatRelatedToMe, int numResultsPerPage) throws SearchException {
+        return search(dataverseRequest, dataverse, query, filterQueries, sortField, sortOrder, paginationStart, onlyDatatRelatedToMe, numResultsPerPage, true);
     }
     
     /**
@@ -145,7 +145,7 @@ public SolrQueryResponse search(User user, Dataverse dataverse, String query, Li
      * @return
      * @throws SearchException
      */
-    public SolrQueryResponse search(User user, Dataverse dataverse, String query, List<String> filterQueries, String sortField, String sortOrder, int paginationStart, boolean onlyDatatRelatedToMe, int numResultsPerPage, boolean retrieveEntities) throws SearchException {
+    public SolrQueryResponse search(DataverseRequest dataverseRequest, Dataverse dataverse, String query, List<String> filterQueries, String sortField, String sortOrder, int paginationStart, boolean onlyDatatRelatedToMe, int numResultsPerPage, boolean retrieveEntities) throws SearchException {
 
         if (paginationStart < 0) {
             throw new IllegalArgumentException("paginationStart must be 0 or greater");
@@ -221,7 +221,7 @@ public SolrQueryResponse search(User user, Dataverse dataverse, String query, Li
         // -----------------------------------
         // PERMISSION FILTER QUERY
         // -----------------------------------
-        String permissionFilterQuery = this.getPermissionFilterQuery(user, solrQuery, dataverse, onlyDatatRelatedToMe);
+        String permissionFilterQuery = this.getPermissionFilterQuery(dataverseRequest, solrQuery, dataverse, onlyDatatRelatedToMe);
         if (permissionFilterQuery != null) {
             solrQuery.addFilterQuery(permissionFilterQuery);
         }
@@ -750,8 +750,9 @@ public String getCapitalizedName(String name) {
      *
      * @return
      */
-    private String getPermissionFilterQuery(User user, SolrQuery solrQuery, Dataverse dataverse, boolean onlyDatatRelatedToMe) {
+    private String getPermissionFilterQuery(DataverseRequest dataverseRequest, SolrQuery solrQuery, Dataverse dataverse, boolean onlyDatatRelatedToMe) {
 
+        User user = dataverseRequest.getUser();
         if (user == null) {
             throw new NullPointerException("user cannot be null");
         }
@@ -776,10 +777,26 @@ private String getPermissionFilterQuery(User user, SolrQuery solrQuery, Datavers
 
         // ----------------------------------------------------
         // (1) Is this a GuestUser?  
-        // Yes, all set, give back "publicOnly" filter string
+        // Yes, see if GuestUser is part of any groups such as IP Groups.
         // ----------------------------------------------------
         if (user instanceof GuestUser) {
-            return publicOnly;
+            String groupsFromProviders = "";
+            Set<Group> groups = groupService.collectAncestors(groupService.groupsFor(dataverseRequest));
+            StringBuilder sb = new StringBuilder();
+            for (Group group : groups) {
+                logger.fine("found group " + group.getIdentifier() + " with alias " + group.getAlias());
+                String groupAlias = group.getAlias();
+                if (groupAlias != null && !groupAlias.isEmpty()) {
+                    sb.append(" OR ");
+                    // i.e. group_builtIn/all-users, ip/ipGroup3
+                    sb.append(IndexServiceBean.getGroupPrefix()).append(groupAlias);
+                }
+            }
+            groupsFromProviders = sb.toString();
+            logger.fine("groupsFromProviders:" + groupsFromProviders);
+            String guestWithGroups = "{!join from=" + SearchFields.DEFINITION_POINT + " to=id}" + SearchFields.DISCOVERABLE_BY + ":(" + IndexServiceBean.getPublicGroupString() + groupsFromProviders + ")";
+            logger.fine(guestWithGroups);
+            return guestWithGroups;
         }
 
         // ----------------------------------------------------
@@ -854,7 +871,7 @@ private String getPermissionFilterQuery(User user, SolrQuery solrQuery, Datavers
          * a given "content document" (dataset version, etc) in Solr.
          */
         String groupsFromProviders = "";
-        Set<Group> groups = groupService.groupsFor(au);
+        Set<Group> groups = groupService.collectAncestors(groupService.groupsFor(dataverseRequest));
         StringBuilder sb = new StringBuilder();
         for (Group group : groups) {
             logger.fine("found group " + group.getIdentifier() + " with alias " + group.getAlias());
diff --git a/src/main/java/edu/harvard/iq/dataverse/search/savedsearch/SavedSearchServiceBean.java b/src/main/java/edu/harvard/iq/dataverse/search/savedsearch/SavedSearchServiceBean.java
index 0694b404098..004e937b425 100644
--- a/src/main/java/edu/harvard/iq/dataverse/search/savedsearch/SavedSearchServiceBean.java
+++ b/src/main/java/edu/harvard/iq/dataverse/search/savedsearch/SavedSearchServiceBean.java
@@ -206,7 +206,7 @@ private SolrQueryResponse findHits(SavedSearch savedSearch) throws SearchExcepti
         boolean dataRelatedToMe = false;
         int numResultsPerPage = Integer.MAX_VALUE;
         SolrQueryResponse solrQueryResponse = searchService.search(
-                savedSearch.getCreator(),
+                new DataverseRequest(savedSearch.getCreator(), getHttpServletRequest()),
                 savedSearch.getDefinitionPoint(),
                 savedSearch.getQuery(),
                 savedSearch.getFilterQueriesAsStrings(),
@@ -297,6 +297,22 @@ public static HttpServletRequest getHttpServletRequest() {
          * different from the one the user may have, and quite possibly more
          * privileged. It maybe safest to pass in a null http request at this
          * stage." -- michbarsinai
+         *
+         * When Saved Search was designed, there was no DataverseRequest object
+         * so what is persisted is the id of the AuthenticatedUser. When a Saved
+         * Search is later re-executed via cron, the AuthenticatedUser is used
+         * but Saved Search has no memory of which IP address was used when the
+         * Saved Search was created. The default IP address in the
+         * DataverseRequest constructor is used instead, which as of this
+         * writing is 0.0.0.0 to mean "undefined". Is this a feature or a bug?
+         * What is the expected interplay between Saved Search and IP Groups?
+         * Users might be surprised to see certain DvObjects in the results of
+         * their query when creating the Saved Search and later find that those
+         * DvObjects, which are only visible due to an IP Groups membership, are
+         * not found by Saved Search when executed by cron, for example. As of
+         * this writing Saved Search is a superuser-only feature so perhaps IP
+         * Groups are irrelevant because all DvObjects are discoverable to
+         * superusers.
          */
         return null;
     }
diff --git a/src/main/java/edu/harvard/iq/dataverse/util/BitSet.java b/src/main/java/edu/harvard/iq/dataverse/util/BitSet.java
index 45f787d6ac6..93e01bac551 100644
--- a/src/main/java/edu/harvard/iq/dataverse/util/BitSet.java
+++ b/src/main/java/edu/harvard/iq/dataverse/util/BitSet.java
@@ -11,10 +11,18 @@ public class BitSet implements Serializable {
 
 	private long store = 0l;
 	
-	public static BitSet emptySet() {
+	/**
+     * Creates a new set with all bits set to 0.
+     * @return a new, empty, set.
+     */
+    public static BitSet emptySet() {
 		return new BitSet();
 	}
 	
+    /**
+     * Creates a new set with all bits set to 1.
+     * @return a new, full, set.
+     */
 	public static BitSet fullSet() {
 		return new BitSet( ~0 );
 	}
diff --git a/src/main/java/edu/harvard/iq/dataverse/util/json/JsonParser.java b/src/main/java/edu/harvard/iq/dataverse/util/json/JsonParser.java
index 3e8a6152558..15961748511 100644
--- a/src/main/java/edu/harvard/iq/dataverse/util/json/JsonParser.java
+++ b/src/main/java/edu/harvard/iq/dataverse/util/json/JsonParser.java
@@ -60,6 +60,10 @@ public JsonParser(DatasetFieldServiceBean datasetFieldSvc, MetadataBlockServiceB
         this.settingsService = settingsService;
     }
 
+    public JsonParser() {
+        this( null,null,null );
+    }
+    
     public boolean isLenient() {
         return lenient;
     }
@@ -186,20 +190,27 @@ public IpGroup parseIpGroup(JsonObject obj) {
         IpGroup retVal = new IpGroup();
 
         if (obj.containsKey("id")) {
-            retVal.setId(Long.valueOf(obj.getString("id")));
+            retVal.setId(Long.valueOf(obj.getInt("id")));
         }
         retVal.setDisplayName(obj.getString("name", null));
         retVal.setDescription(obj.getString("description", null));
         retVal.setPersistedGroupAlias(obj.getString("alias", null));
 
-        JsonArray rangeArray = obj.getJsonArray("ranges");
-        for (JsonValue range : rangeArray) {
-            if (range.getValueType() == JsonValue.ValueType.ARRAY) {
-                JsonArray rr = (JsonArray) range;
-                retVal.add(IpAddressRange.make(IpAddress.valueOf(rr.getString(0)),
-                        IpAddress.valueOf(rr.getString(1))));
-
-            }
+        if ( obj.containsKey("ranges") ) {
+            obj.getJsonArray("ranges").stream()
+                    .filter( jv -> jv.getValueType()==JsonValue.ValueType.ARRAY )
+                    .map( jv -> (JsonArray)jv )
+                    .forEach( rr -> {
+                        retVal.add(
+                            IpAddressRange.make(IpAddress.valueOf(rr.getString(0)),
+                                                IpAddress.valueOf(rr.getString(1))));
+            });
+        }
+        if ( obj.containsKey("addresses") ) {
+            obj.getJsonArray("addresses").stream()
+                    .map( jsVal -> IpAddress.valueOf(((JsonString)jsVal).getString()) )
+                    .map( addr -> IpAddressRange.make(addr, addr) )
+                    .forEach( retVal::add );
         }
 
         return retVal;
diff --git a/src/main/java/edu/harvard/iq/dataverse/util/json/JsonPrinter.java b/src/main/java/edu/harvard/iq/dataverse/util/json/JsonPrinter.java
index 1f8e4cc80cd..c3fbb45c4ad 100644
--- a/src/main/java/edu/harvard/iq/dataverse/util/json/JsonPrinter.java
+++ b/src/main/java/edu/harvard/iq/dataverse/util/json/JsonPrinter.java
@@ -23,6 +23,7 @@
 import edu.harvard.iq.dataverse.authorization.RoleAssigneeDisplayInfo;
 import edu.harvard.iq.dataverse.authorization.groups.impl.explicit.ExplicitGroup;
 import edu.harvard.iq.dataverse.authorization.groups.impl.ipaddress.IpGroup;
+import edu.harvard.iq.dataverse.authorization.groups.impl.ipaddress.ip.IpAddress;
 import edu.harvard.iq.dataverse.authorization.groups.impl.ipaddress.ip.IpAddressRange;
 import edu.harvard.iq.dataverse.authorization.groups.impl.shib.ShibGroup;
 import edu.harvard.iq.dataverse.authorization.providers.AuthenticationProviderRow;
@@ -31,6 +32,7 @@
 import edu.harvard.iq.dataverse.privateurl.PrivateUrl;
 import edu.harvard.iq.dataverse.util.DatasetFieldWalker;
 import edu.harvard.iq.dataverse.util.StringUtil;
+import static edu.harvard.iq.dataverse.util.json.NullSafeJsonBuilder.jsonObjectBuilder;
 import java.util.Set;
 import javax.json.Json;
 import javax.json.JsonArrayBuilder;
@@ -39,14 +41,21 @@
 import java.util.List;
 import java.util.TreeSet;
 
-import static edu.harvard.iq.dataverse.util.json.NullSafeJsonBuilder.jsonObjectBuilder;
-import java.math.BigDecimal;
+import java.util.Arrays;
 import java.util.Collection;
 import java.util.Deque;
+import java.util.EnumSet;
 import java.util.LinkedList;
 import java.util.Map;
+import java.util.function.BiConsumer;
+import java.util.function.BinaryOperator;
+import java.util.function.Function;
+import java.util.function.Supplier;
+import java.util.stream.Collector;
+import static java.util.stream.Collectors.toList;
 import javax.json.JsonArray;
 import javax.json.JsonObject;
+import javax.json.JsonValue;
 
 /**
  * Convert objects to Json.
@@ -121,17 +130,33 @@ public static JsonObjectBuilder json( RoleAssigneeDisplayInfo d ) {
     }
 
     public static JsonObjectBuilder json(IpGroup grp) {
-        JsonArrayBuilder rangeBld = Json.createArrayBuilder();
-        for (IpAddressRange r : grp.getRanges()) {
-            rangeBld.add(Json.createArrayBuilder().add(r.getBottom().toString()).add(r.getTop().toString()));
-        }
-        return jsonObjectBuilder()
-                .add("alias", grp.getPersistedGroupAlias())
+         // collect single addresses
+        List<String> singles = grp.getRanges().stream().filter( IpAddressRange::isSingleAddress )
+                                .map( IpAddressRange::getBottom )
+                                .map( IpAddress::toString ).collect(toList());
+        // collect "real" ranges
+        List<List<String>> ranges = grp.getRanges().stream().filter( rng -> !rng.isSingleAddress() )
+                                .map( rng -> Arrays.asList(rng.getBottom().toString(), rng.getTop().toString()) )
+                                .collect(toList());
+
+        JsonObjectBuilder bld = jsonObjectBuilder()
+                .add("alias", grp.getPersistedGroupAlias() )
                 .add("identifier", grp.getIdentifier())
-                .add("id", grp.getId())
-                .add("name", grp.getDisplayName())
-                .add("description", grp.getDescription())
-                .add("ranges", rangeBld);
+                .add("id", grp.getId() )
+                .add("name", grp.getDisplayName() )
+                .add("description", grp.getDescription() );
+       
+        if ( ! singles.isEmpty() ) {
+            bld.add("addresses", asJsonArray(singles) );
+        }
+        
+        if ( ! ranges.isEmpty() ) {
+            JsonArrayBuilder rangesBld = Json.createArrayBuilder();
+            ranges.forEach( r -> rangesBld.add( Json.createArrayBuilder().add(r.get(0)).add(r.get(1))) );
+            bld.add("ranges", rangesBld );
+        }
+        
+        return bld;
     }
 
     public static JsonObjectBuilder json(ShibGroup grp) {
@@ -590,4 +615,75 @@ public static <T> JsonArrayBuilder json(Collection<T> jc) {
         }
         return bld;
     }
+
+        public static Collector<String, JsonArrayBuilder, JsonArrayBuilder> stringsToJsonArray() {
+        return new Collector<String, JsonArrayBuilder, JsonArrayBuilder>() {
+
+            @Override
+            public Supplier<JsonArrayBuilder> supplier() {
+                return () -> Json.createArrayBuilder();
+            }
+
+            @Override
+            public BiConsumer<JsonArrayBuilder, String> accumulator() {
+                return (JsonArrayBuilder b, String s) -> b.add(s);
+            }
+
+            @Override
+            public BinaryOperator<JsonArrayBuilder> combiner() {
+                return (jab1, jab2) -> {
+                    JsonArrayBuilder retVal = Json.createArrayBuilder();
+                    jab1.build().forEach(retVal::add);
+                    jab2.build().forEach(retVal::add);
+                    return retVal;
+                };
+            }
+
+            @Override
+            public Function<JsonArrayBuilder, JsonArrayBuilder> finisher() {
+                return Function.identity();
+            }
+
+            @Override
+            public Set<Collector.Characteristics> characteristics() {
+                return EnumSet.of(Collector.Characteristics.IDENTITY_FINISH);
+            }
+        };
+    }
+
+    public static Collector<JsonValue, JsonArrayBuilder, JsonArrayBuilder> toJsonArray() {
+        return new Collector<JsonValue, JsonArrayBuilder, JsonArrayBuilder>() {
+
+            @Override
+            public Supplier<JsonArrayBuilder> supplier() {
+                return () -> Json.createArrayBuilder();
+            }
+
+            @Override
+            public BiConsumer<JsonArrayBuilder, JsonValue> accumulator() {
+                return (JsonArrayBuilder b, JsonValue s) -> b.add(s);
+            }
+
+            @Override
+            public BinaryOperator<JsonArrayBuilder> combiner() {
+                return (jab1, jab2) -> {
+                    JsonArrayBuilder retVal = Json.createArrayBuilder();
+                    jab1.build().forEach(retVal::add);
+                    jab2.build().forEach(retVal::add);
+                    return retVal;
+                };
+            }
+
+            @Override
+            public Function<JsonArrayBuilder, JsonArrayBuilder> finisher() {
+                return Function.identity();
+            }
+
+            @Override
+            public Set<Collector.Characteristics> characteristics() {
+                return EnumSet.of(Collector.Characteristics.IDENTITY_FINISH);
+            }
+        };
+    }
+
 }
diff --git a/src/test/java/edu/harvard/iq/dataverse/authorization/groups/GroupServiceBeanTest.java b/src/test/java/edu/harvard/iq/dataverse/authorization/groups/GroupServiceBeanTest.java
new file mode 100644
index 00000000000..ea9f851f9ed
--- /dev/null
+++ b/src/test/java/edu/harvard/iq/dataverse/authorization/groups/GroupServiceBeanTest.java
@@ -0,0 +1,120 @@
+package edu.harvard.iq.dataverse.authorization.groups;
+
+import edu.harvard.iq.dataverse.Dataverse;
+import edu.harvard.iq.dataverse.authorization.groups.impl.builtin.AllUsers;
+import edu.harvard.iq.dataverse.authorization.groups.impl.builtin.AuthenticatedUsers;
+import edu.harvard.iq.dataverse.authorization.groups.impl.explicit.ExplicitGroup;
+import edu.harvard.iq.dataverse.authorization.groups.impl.explicit.ExplicitGroupProvider;
+import edu.harvard.iq.dataverse.mocks.MockExplicitGroupService;
+import edu.harvard.iq.dataverse.mocks.MockRoleAssigneeServiceBean;
+import edu.harvard.iq.dataverse.mocks.MocksFactory;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Set;
+import static java.util.stream.Collectors.toList;
+import java.util.stream.Stream;
+import static org.junit.Assert.assertEquals;
+import org.junit.Test;
+import static edu.harvard.iq.dataverse.util.CollectionLiterals.*;
+
+/**
+ *
+ * @author michael
+ */
+public class GroupServiceBeanTest {
+    
+    public GroupServiceBeanTest() {
+    }
+
+    @Test
+    public void testFlattenGroupsCollection() throws GroupException {
+        // Setup
+        MockRoleAssigneeServiceBean roleAssigneeSvc = new MockRoleAssigneeServiceBean();
+        ExplicitGroupProvider prv = new ExplicitGroupProvider(null, roleAssigneeSvc);
+        ExplicitGroup gA = new ExplicitGroup(prv);
+        gA.setDisplayName("A");
+        ExplicitGroup gAa = new ExplicitGroup(prv);
+        gAa.setDisplayName("Aa");
+        ExplicitGroup gAb = new ExplicitGroup(prv);
+        gAb.setDisplayName("Ab");
+        ExplicitGroup gAstar = new ExplicitGroup(prv);
+        gAstar.setDisplayName("A*");
+        Dataverse dv = MocksFactory.makeDataverse();
+        Stream.of( gA, gAa, gAb, gAstar).forEach( g -> {
+            g.setId( MocksFactory.nextId() );
+            g.setOwner(dv);
+            g.setGroupAliasInOwner( g.getDisplayName() );
+            roleAssigneeSvc.add(g);
+            g.updateAlias();
+        });
+        
+        // create some containment hierarchy.
+        gA.add(gAa);
+        gA.add(gAb);
+        gAb.add(gAstar);
+        gAa.add(gAstar);
+        gAa.add( AuthenticatedUsers.get() );
+        
+        // Test
+        GroupServiceBean sut = new GroupServiceBean();
+        sut.roleAssigneeSvc = roleAssigneeSvc;
+        
+        Set<Group> grps = setOf( AllUsers.get(), gA );
+                
+        List<Group> result = sut.flattenGroupsCollection(grps).collect(toList());
+        
+        assertEquals( "Groups should appear only once", result.size(), new HashSet<>(result).size() );
+        
+        grps.addAll( listOf(gAa, gAb, gAstar, AuthenticatedUsers.get()) );
+        assertEquals( "All groups should appear", grps, new HashSet<>(result) );
+        
+    }
+    
+    @Test
+    public void testCollectAncestors() throws GroupException {
+        // Setup
+        MockRoleAssigneeServiceBean roleAssigneeSvc = new MockRoleAssigneeServiceBean();
+        MockExplicitGroupService explicitGroupSvc = new MockExplicitGroupService();
+        ExplicitGroupProvider prv = new ExplicitGroupProvider(null, roleAssigneeSvc);
+        
+        ExplicitGroup gA = new ExplicitGroup(prv);
+        gA.setDisplayName("A");
+        ExplicitGroup gAa = new ExplicitGroup(prv);
+        gAa.setDisplayName("Aa");
+        ExplicitGroup gAb = new ExplicitGroup(prv);
+        gAb.setDisplayName("Ab");
+        ExplicitGroup gAstar = new ExplicitGroup(prv);
+        gAstar.setDisplayName("A*");
+        Dataverse dv = MocksFactory.makeDataverse();
+        Stream.of( gA, gAa, gAb, gAstar).forEach( g -> {
+            g.setId( MocksFactory.nextId() );
+            g.setOwner(dv);
+            g.setGroupAliasInOwner( g.getDisplayName() );
+            g.updateAlias();
+            roleAssigneeSvc.add(g);
+            explicitGroupSvc.registerGroup(g);
+        });
+        
+        // create some containment hierarchy.
+        gA.add(gAa);
+        gA.add(gAb);
+        gAb.add(gAstar);
+        gAa.add(gAstar);
+        gAa.add(AuthenticatedUsers.get());
+        
+        // Test
+        GroupServiceBean sut = new GroupServiceBean();
+        sut.roleAssigneeSvc = roleAssigneeSvc;
+        sut.explicitGroupService = explicitGroupSvc;
+        
+        assertEquals( setOf(gA), sut.collectAncestors(setOf(gA)) );
+        assertEquals( setOf(gA, gAb), sut.collectAncestors(setOf(gAb)) );
+        assertEquals( setOf(gA, gAa, AuthenticatedUsers.get()), 
+                      sut.collectAncestors(setOf(AuthenticatedUsers.get())) );
+        assertEquals( setOf(gA, gAb, gAa, gAstar), 
+                      sut.collectAncestors(setOf(gAstar)) );
+        
+    }
+    
+    
+}
diff --git a/src/test/java/edu/harvard/iq/dataverse/authorization/groups/impl/explicit/ExplicitGroupTest.java b/src/test/java/edu/harvard/iq/dataverse/authorization/groups/impl/explicit/ExplicitGroupTest.java
new file mode 100644
index 00000000000..543d3ab1eeb
--- /dev/null
+++ b/src/test/java/edu/harvard/iq/dataverse/authorization/groups/impl/explicit/ExplicitGroupTest.java
@@ -0,0 +1,216 @@
+/*
+ *  (C) Michael Bar-Sinai
+ */
+package edu.harvard.iq.dataverse.authorization.groups.impl.explicit;
+
+import edu.harvard.iq.dataverse.Dataverse;
+import edu.harvard.iq.dataverse.authorization.groups.GroupException;
+import edu.harvard.iq.dataverse.authorization.groups.impl.builtin.AllUsers;
+import edu.harvard.iq.dataverse.authorization.groups.impl.builtin.AuthenticatedUsers;
+import edu.harvard.iq.dataverse.authorization.groups.impl.ipaddress.IpGroup;
+import edu.harvard.iq.dataverse.authorization.groups.impl.ipaddress.IpGroupProvider;
+import edu.harvard.iq.dataverse.authorization.groups.impl.ipaddress.ip.IpAddress;
+import edu.harvard.iq.dataverse.authorization.groups.impl.ipaddress.ip.IpAddressRange;
+import edu.harvard.iq.dataverse.authorization.users.AuthenticatedUser;
+import edu.harvard.iq.dataverse.authorization.users.GuestUser;
+import edu.harvard.iq.dataverse.engine.command.DataverseRequest;
+import edu.harvard.iq.dataverse.mocks.MockRoleAssigneeServiceBean;
+import static edu.harvard.iq.dataverse.mocks.MocksFactory.*;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+import static org.junit.Assert.fail;
+import org.junit.Test;
+
+/**
+ *
+ * @author michael
+ */
+public class ExplicitGroupTest {
+    
+    
+    MockRoleAssigneeServiceBean roleAssigneeSvc = new MockRoleAssigneeServiceBean();
+    ExplicitGroupProvider prv = new ExplicitGroupProvider(null, roleAssigneeSvc);
+    
+    public ExplicitGroupTest() {
+    }
+    
+    @Test( expected=GroupException.class )
+    public void addGroupToSelf() throws Exception {
+        ExplicitGroup sut = new ExplicitGroup();
+        sut.setDisplayName("a group");
+        sut.add( sut );
+        fail("A group cannot be added to itself.");
+    }
+    
+    @Test( expected=GroupException.class )
+    public void addGroupToDescendant() throws GroupException{
+        Dataverse dv = makeDataverse();
+        ExplicitGroup root = new ExplicitGroup(prv);
+        root.setId( nextId() );
+        root.setGroupAliasInOwner("top");
+        ExplicitGroup sub = new ExplicitGroup(prv);
+        sub.setGroupAliasInOwner("sub");
+        sub.setId( nextId() );
+        ExplicitGroup subSub = new ExplicitGroup(prv);
+        subSub.setGroupAliasInOwner("subSub");
+        subSub.setId( nextId() );
+        root.setOwner(dv);
+        sub.setOwner(dv);
+        subSub.setOwner(dv);
+        
+        sub.add( subSub );
+        root.add( sub );
+        subSub.add(root);
+        fail("A group cannot contain its parent");
+    }
+    
+    @Test( expected=GroupException.class )
+    public void addGroupToUnrealtedGroup() throws GroupException {
+        Dataverse dv1 = makeDataverse();
+        Dataverse dv2 = makeDataverse();
+        ExplicitGroup g1 = new ExplicitGroup(prv);
+        ExplicitGroup g2 = new ExplicitGroup(prv);
+        g1.setOwner(dv1);
+        g2.setOwner(dv2);
+        
+        g1.add(g2);
+        fail("An explicit group cannot contain an explicit group defined in "
+                + "a dataverse that's not an ancestor of that group's owner dataverse.");
+        
+    }
+    
+    @Test
+    public void addGroup() throws GroupException {
+        Dataverse dvParent = makeDataverse();
+        Dataverse dvSub = makeDataverse();
+        dvSub.setOwner(dvParent);
+        
+        ExplicitGroup g1 = new ExplicitGroup(prv);
+        ExplicitGroup g2 = new ExplicitGroup(prv);
+        g1.setOwner(dvSub);
+        g2.setOwner(dvParent);
+        
+        g1.add(g2);
+        assertTrue( g1.structuralContains(g2) );
+    }
+    
+    @Test
+    public void adds() throws GroupException {
+        Dataverse dvParent = makeDataverse();
+        ExplicitGroup g1 = new ExplicitGroup(prv);
+        g1.setOwner(dvParent);
+        
+        AuthenticatedUser au1 = makeAuthenticatedUser("Lauren", "Ipsum");
+        g1.add(au1);
+        g1.add( GuestUser.get() );
+        
+        assertTrue( g1.structuralContains(GuestUser.get()) );
+        assertTrue( g1.structuralContains(au1) );
+        assertFalse( g1.structuralContains(makeAuthenticatedUser("Sima", "Kneidle")) );
+        assertFalse( g1.structuralContains(AllUsers.get()) );
+    }
+    
+    
+    @Test
+    public void recursiveStructuralContainment() throws GroupException {
+        Dataverse dvParent = makeDataverse();
+        ExplicitGroup parentGroup     = roleAssigneeSvc.add(makeExplicitGroup(prv));
+        ExplicitGroup childGroup      = roleAssigneeSvc.add(makeExplicitGroup(prv));
+        ExplicitGroup grandChildGroup = roleAssigneeSvc.add(makeExplicitGroup(prv));
+        parentGroup.setOwner(dvParent);
+        childGroup.setOwner(dvParent);
+        grandChildGroup.setOwner(dvParent);
+        
+        childGroup.add(grandChildGroup);
+        parentGroup.add(childGroup);
+        
+        AuthenticatedUser au = roleAssigneeSvc.add(makeAuthenticatedUser("Jane", "Doe"));
+        grandChildGroup.add( au );
+        childGroup.add( GuestUser.get() );
+        
+        assertTrue( grandChildGroup.structuralContains(au) );
+        assertTrue( childGroup.structuralContains(au) );
+        assertTrue( parentGroup.structuralContains(au) );
+        
+        assertTrue( childGroup.structuralContains(GuestUser.get()) );
+        assertTrue( parentGroup.structuralContains(GuestUser.get()) );
+        
+        grandChildGroup.remove(au);
+        
+        assertFalse( grandChildGroup.structuralContains(au) );
+        assertFalse( childGroup.structuralContains(au) );
+        assertFalse( parentGroup.structuralContains(au) );
+        
+        childGroup.add( AuthenticatedUsers.get() );
+        
+        assertFalse( grandChildGroup.structuralContains(au) );
+        assertFalse( childGroup.structuralContains(au) );
+        assertFalse( parentGroup.structuralContains(au) );
+        assertTrue( childGroup.structuralContains(AuthenticatedUsers.get()) );
+
+        final IpGroup ipGroup = new IpGroup(new IpGroupProvider(null));
+        grandChildGroup.add(ipGroup);
+        ipGroup.add( IpAddressRange.make(IpAddress.valueOf("0.0.1.1"), IpAddress.valueOf("0.0.255.255")) );
+        
+        assertTrue( grandChildGroup.structuralContains(ipGroup) );
+        assertTrue( childGroup.structuralContains(ipGroup) );
+        assertTrue( parentGroup.structuralContains(ipGroup) );
+    }
+    
+    @Test
+    public void recursiveLogicalContainment() throws GroupException {
+        Dataverse dvParent = makeDataverse();
+        ExplicitGroup parentGroup     = roleAssigneeSvc.add(makeExplicitGroup("parent", prv));
+        ExplicitGroup childGroup      = roleAssigneeSvc.add(makeExplicitGroup("child", prv));
+        ExplicitGroup grandChildGroup = roleAssigneeSvc.add(makeExplicitGroup("grandChild", prv));
+        parentGroup.setOwner(dvParent);
+        childGroup.setOwner(dvParent);
+        grandChildGroup.setOwner(dvParent);
+        
+        childGroup.add(grandChildGroup);
+        parentGroup.add(childGroup);
+        
+        AuthenticatedUser au = roleAssigneeSvc.add(makeAuthenticatedUser("Jane", "Doe"));
+        grandChildGroup.add( au );
+        childGroup.add( GuestUser.get() );
+        DataverseRequest auReq = makeRequest(au);
+        DataverseRequest guestReq = makeRequest();
+        
+        assertTrue( grandChildGroup.contains(auReq) );
+        assertTrue( childGroup.contains(auReq) );
+        assertTrue( parentGroup.contains(auReq) );
+        
+        assertTrue( childGroup.contains(guestReq) );
+        assertTrue( parentGroup.contains(guestReq) );
+        
+        grandChildGroup.remove(au);
+        
+        assertFalse( grandChildGroup.contains(auReq) );
+        assertFalse( childGroup.contains(auReq) );
+        assertFalse( parentGroup.contains(auReq) );
+        
+        childGroup.add( AuthenticatedUsers.get() );
+        
+        assertFalse( grandChildGroup.contains(auReq) );
+        assertTrue( childGroup.contains(auReq) );
+        assertTrue( parentGroup.contains(auReq) );
+
+        final IpGroup ipGroup = roleAssigneeSvc.add( new IpGroup(new IpGroupProvider(null)) );
+        grandChildGroup.add(ipGroup);
+        ipGroup.add( IpAddressRange.make(IpAddress.valueOf("0.0.1.1"), IpAddress.valueOf("0.0.255.255")) );
+        final IpAddress ip = IpAddress.valueOf("0.0.128.128");
+        final DataverseRequest request = new DataverseRequest(GuestUser.get(), ip);
+        
+        assertTrue( ipGroup.contains(request) ); 
+        assertTrue( grandChildGroup.contains(request) );
+        assertTrue( parentGroup.contains(request) );
+        
+        childGroup.add( GuestUser.get() );
+        assertTrue( childGroup.contains(guestReq) );
+        assertTrue( parentGroup.contains(guestReq) );
+        assertFalse( grandChildGroup.contains(guestReq) );
+        
+    }
+}
+
+
diff --git a/src/test/java/edu/harvard/iq/dataverse/authorization/groups/impl/ipaddress/IpGroupTest.java b/src/test/java/edu/harvard/iq/dataverse/authorization/groups/impl/ipaddress/IpGroupTest.java
new file mode 100644
index 00000000000..b6a3b862435
--- /dev/null
+++ b/src/test/java/edu/harvard/iq/dataverse/authorization/groups/impl/ipaddress/IpGroupTest.java
@@ -0,0 +1,91 @@
+package edu.harvard.iq.dataverse.authorization.groups.impl.ipaddress;
+
+import edu.harvard.iq.dataverse.authorization.groups.impl.ipaddress.ip.IpAddress;
+import edu.harvard.iq.dataverse.authorization.groups.impl.ipaddress.ip.IpAddressRange;
+import edu.harvard.iq.dataverse.authorization.users.GuestUser;
+import edu.harvard.iq.dataverse.engine.command.DataverseRequest;
+import edu.harvard.iq.dataverse.mocks.MocksFactory;
+import org.junit.Test;
+import static org.junit.Assert.*;
+
+/**
+ *
+ * @author michael
+ */
+public class IpGroupTest {
+    
+    public IpGroupTest() {
+    }
+
+    /**
+     * Test of contains method, of class IpGroup.
+     */
+    @Test
+    public void testContains() {
+        IpGroup sut = new IpGroup();
+        sut.setId(MocksFactory.nextId());
+        sut.setDescription("A's description");
+        sut.setDisplayName("A");
+        sut.setPersistedGroupAlias("&ip/a");
+        final IpAddressRange allIPv4 = IpAddressRange.make(IpAddress.valueOf("0.0.0.0"), IpAddress.valueOf("255.255.255.255"));
+        final IpAddressRange allIPv6 = IpAddressRange.make(IpAddress.valueOf("0:0:0:0:0:0:0:0"),
+                IpAddress.valueOf("ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff"));
+        
+        sut.add(allIPv4);
+        sut.add(allIPv6);
+        
+        assertTrue( sut.contains(new DataverseRequest(GuestUser.get(), IpAddress.valueOf("1.2.3.4"))) );
+        assertTrue( sut.contains(new DataverseRequest(GuestUser.get(), IpAddress.valueOf("11::fff"))) );
+        
+        sut.remove( allIPv4 );
+        assertFalse( sut.contains(new DataverseRequest(GuestUser.get(), IpAddress.valueOf("1.2.3.4"))) );
+        
+        sut.remove( allIPv6 );
+        assertFalse( sut.contains(new DataverseRequest(GuestUser.get(), IpAddress.valueOf("11::fff"))) );
+        
+        sut.add( IpAddressRange.make(IpAddress.valueOf("0.0.0.0"), IpAddress.valueOf("168.0.0.0")) );
+        assertFalse( sut.contains(new DataverseRequest(GuestUser.get(), IpAddress.valueOf("169.0.0.0"))) );
+        assertTrue( sut.contains(new DataverseRequest(GuestUser.get(), IpAddress.valueOf("167.0.0.0"))) );
+        
+    }
+
+ 
+    /**
+     * Test of isEditable method, of class IpGroup.
+     */
+    @Test
+    public void testIsEditable() {
+        IpGroup instance = new IpGroup();
+        assertTrue( instance.isEditable() );
+    }
+
+    /**
+     * Test of equals method, of class IpGroup.
+     */
+    @Test
+    public void testEquals() {
+        IpGroup a = new IpGroup();
+        a.setId(MocksFactory.nextId());
+        a.setDescription("A's description");
+        a.setDisplayName("A");
+        a.setPersistedGroupAlias("&ip/a");
+        a.add( IpAddressRange.make(IpAddress.valueOf("0.0.0.0"), IpAddress.valueOf("1.1.1.1")));
+        
+        assertFalse( a.equals("banana") );
+        assertFalse( a.equals( null ) );
+        assertTrue( a.equals( a) );
+        
+        IpGroup aa = new IpGroup();
+        aa.setId(a.getId());
+        aa.setDescription("A's description");
+        aa.setDisplayName("A");
+        aa.setPersistedGroupAlias("&ip/a");
+        aa.add( IpAddressRange.make(IpAddress.valueOf("0.0.0.0"), IpAddress.valueOf("1.1.1.1")));
+        
+        assertTrue( a.equals(aa) );
+        aa.add( IpAddressRange.make(IpAddress.valueOf("9.0.0.0"), IpAddress.valueOf("9.1.1.1")));
+        assertFalse( a.equals(aa) );
+        
+    }
+    
+}
diff --git a/src/test/java/edu/harvard/iq/dataverse/authorization/groups/impl/ipaddress/ip/IPv4AddressTest.java b/src/test/java/edu/harvard/iq/dataverse/authorization/groups/impl/ipaddress/ip/IPv4AddressTest.java
index d853dc36f86..d03846a97b4 100644
--- a/src/test/java/edu/harvard/iq/dataverse/authorization/groups/impl/ipaddress/ip/IPv4AddressTest.java
+++ b/src/test/java/edu/harvard/iq/dataverse/authorization/groups/impl/ipaddress/ip/IPv4AddressTest.java
@@ -1,6 +1,7 @@
 package edu.harvard.iq.dataverse.authorization.groups.impl.ipaddress.ip;
 
-import edu.harvard.iq.dataverse.authorization.groups.impl.ipaddress.ip.IPv4Address;
+import java.math.BigDecimal;
+import java.math.BigInteger;
 import java.util.Arrays;
 import org.junit.Test;
 import static org.junit.Assert.*;
@@ -57,7 +58,7 @@ public void testComparator() {
     
     @Test
     public void testLongRoundtrip() {
-        for ( IPv4Address addr : Arrays.asList(
+        Arrays.asList(
                 new IPv4Address(127,0,36,255),
                 new IPv4Address(0,0,0,0),
                 new IPv4Address(127,0,0,1),
@@ -67,10 +68,36 @@ public void testLongRoundtrip() {
                 new IPv4Address(128,128,128,128),
                 new IPv4Address(127,127,127,127),
                 new IPv4Address(255,255,255,255),
-                new IPv4Address(255,0,34,1)) ) {
-            assertEquals( addr, new IPv4Address(addr.toLong()) );
-        }
+                new IPv4Address(255,0,34,1)
+        ).forEach( addr -> assertEquals( addr, new IPv4Address(addr.toLong())) );
     }
     
+    @Test
+    public void testBigIntegerRoundtrip() {
+        Arrays.asList(
+                new IPv4Address(0,0,0,0),
+                new IPv4Address(0,0,0,1),
+                new IPv4Address(0,0,1,0),
+                new IPv4Address(0,1,0,0),
+                new IPv4Address(1,0,0,0),
+                new IPv4Address(1,1,1,1),
+                new IPv4Address(0,0,127,1),
+                new IPv4Address(127,0,36,255),
+                new IPv4Address(127,0,0,1),
+                new IPv4Address(128,0,0,1),
+                new IPv4Address(0,0,128,1),
+                new IPv4Address(128,128,128,128),
+                new IPv4Address(127,127,127,127),
+                new IPv4Address(255,255,255,255),
+                new IPv4Address(255,0,34,1)
+        ).forEach( addr -> assertEquals( addr, new IPv4Address(addr.toBigInteger())) );
+    }
     
+    @Test
+    public void toBigInteger() {
+        assertEquals( BigInteger.ZERO, new IPv4Address(0,0,0,0).toBigInteger() );
+        assertEquals( BigInteger.ONE, new IPv4Address(0,0,0,1).toBigInteger() );
+        assertEquals( BigInteger.ONE.shiftLeft(8),
+                        new IPv4Address(0,0,1,0).toBigInteger() );
+    }
 }
diff --git a/src/test/java/edu/harvard/iq/dataverse/authorization/groups/impl/ipaddress/ip/IPv6AddressTest.java b/src/test/java/edu/harvard/iq/dataverse/authorization/groups/impl/ipaddress/ip/IPv6AddressTest.java
index 3c51d2dc168..2070dc347e7 100644
--- a/src/test/java/edu/harvard/iq/dataverse/authorization/groups/impl/ipaddress/ip/IPv6AddressTest.java
+++ b/src/test/java/edu/harvard/iq/dataverse/authorization/groups/impl/ipaddress/ip/IPv6AddressTest.java
@@ -11,204 +11,215 @@
  * @author michael
  */
 public class IPv6AddressTest {
-    
+
     public IPv6AddressTest() {
     }
-    
+
     @Before
     public void setUp() {
     }
-    
+
     @After
     public void tearDown() {
     }
 
     @Test
     public void testValueOfNoExpansion() {
-        int[] expected = new int[]{0x2001,0xdb8,0x85a3,0x0,0x0,0x8a2e,0x370,0x7334};
+        int[] expected = new int[]{0x2001, 0xdb8, 0x85a3, 0x0, 0x0, 0x8a2e, 0x370, 0x7334};
         IPv6Address adr = IPv6Address.valueOf("2001:db8:85a3:0:0:8a2e:370:7334");
-        for ( int i=0; i<8; i++ ) {
+        for (int i = 0; i < 8; i++) {
             assertEquals(expected[i], adr.get(i));
         }
     }
-    
+
     @Test
     public void testValueOfWithExpansion() {
-        int[] expected = new int[]{0x2001,0xdb8,0x85a3,0x0,0,0x8a2e,0x370,0x7334};
+        int[] expected = new int[]{0x2001, 0xdb8, 0x85a3, 0x0, 0, 0x8a2e, 0x370, 0x7334};
         IPv6Address adr = IPv6Address.valueOf("2001:db8:85a3::8a2e:370:7334");
-        for ( int i=0; i<8; i++ ) {
+        for (int i = 0; i < 8; i++) {
             assertEquals("At index " + i + ": expecting " + expected[i] + ", got " + adr.get(i),
-                         expected[i], adr.get(i));
+                    expected[i], adr.get(i));
         }
-        
-        expected = new int[]{0x2001,0xdb8,0x0,0x0,0x0,0x0,0x370,0x7334};
+
+        expected = new int[]{0x2001, 0xdb8, 0x0, 0x0, 0x0, 0x0, 0x370, 0x7334};
         adr = IPv6Address.valueOf("2001:db8::370:7334");
-        for ( int i=0; i<8; i++ ) {
+        for (int i = 0; i < 8; i++) {
             assertEquals("At index " + i + ": expecting " + expected[i] + ", got " + adr.get(i),
-                         expected[i], adr.get(i));
+                    expected[i], adr.get(i));
         }
     }
-    
+
     @Test
     public void testValueOfWithExpansionZerosAtStart() {
-        int[] expected = new int[]{0,0,0,0,0,0x8a2e,0x370,0x7334};
+        int[] expected = new int[]{0, 0, 0, 0, 0, 0x8a2e, 0x370, 0x7334};
         IPv6Address adr = IPv6Address.valueOf("::8a2e:370:7334");
-        for ( int i=0; i<8; i++ ) {
+        for (int i = 0; i < 8; i++) {
             assertEquals("At index " + i + ": expecting " + expected[i] + ", got " + adr.get(i),
-                         expected[i], adr.get(i));
+                    expected[i], adr.get(i));
         }
-        
-        expected = new int[]{0,0,0,0,0,0,0,0x7334};
+
+        expected = new int[]{0, 0, 0, 0, 0, 0, 0, 0x7334};
         adr = IPv6Address.valueOf("::7334");
         System.out.println("adr = " + adr);
-        for ( int i=0; i<8; i++ ) {
+        for (int i = 0; i < 8; i++) {
             assertEquals("At index " + i + ": expecting " + expected[i] + ", got " + adr.get(i),
-                         expected[i], adr.get(i));
+                    expected[i], adr.get(i));
         }
     }
-    
+
     @Test
     public void testValueOfWithExpansionZerosAtEnd() {
-        int[] expected = new int[]{0x2001,0x8a2e,0,0,0,0,0,0};
+        int[] expected = new int[]{0x2001, 0x8a2e, 0, 0, 0, 0, 0, 0};
         IPv6Address adr = IPv6Address.valueOf("2001:8a2e::");
-        for ( int i=0; i<8; i++ ) {
+        for (int i = 0; i < 8; i++) {
             assertEquals("At index " + i + ": expecting " + expected[i] + ", got " + adr.get(i),
-                         expected[i], adr.get(i));
+                    expected[i], adr.get(i));
         }
-        
-        expected = new int[]{0x1337,0,0,0,0,0,0,0};
+
+        expected = new int[]{0x1337, 0, 0, 0, 0, 0, 0, 0};
         adr = IPv6Address.valueOf("1337::");
-        for ( int i=0; i<8; i++ ) {
+        for (int i = 0; i < 8; i++) {
             assertEquals("At index " + i + ": expecting " + expected[i] + ", got " + adr.get(i),
-                         expected[i], adr.get(i));
+                    expected[i], adr.get(i));
         }
     }
-    
-    
+
     @Test
     public void testValueOfWithExpansionSpecialCases() {
-        int[] expected = new int[]{0,0,0,0,0,0,0,0};
+        int[] expected = new int[]{0, 0, 0, 0, 0, 0, 0, 0};
         IPv6Address adr = IPv6Address.valueOf("::");
         System.out.println("adr = " + adr);
-        for ( int i=0; i<8; i++ ) {
+        for (int i = 0; i < 8; i++) {
             assertEquals("At index " + i + ": expecting " + expected[i] + ", got " + adr.get(i),
-                         expected[i], adr.get(i));
+                    expected[i], adr.get(i));
         }
-        
-        expected = new int[]{0,0,0,0,0,0,0,1};
+
+        expected = new int[]{0, 0, 0, 0, 0, 0, 0, 1};
         adr = IPv6Address.valueOf("::1");
-        for ( int i=0; i<8; i++ ) {
+        for (int i = 0; i < 8; i++) {
             assertEquals("At index " + i + ": expecting " + expected[i] + ", got " + adr.get(i),
-                         expected[i], adr.get(i));
+                    expected[i], adr.get(i));
         }
     }
-    
+
     @Test
     public void testLocalhostness() {
-        assertTrue( IPv6Address.valueOf("::1").isLocalhost() );
-        assertFalse( IPv6Address.valueOf("fff::1").isLocalhost() );
+        assertTrue(IPv6Address.valueOf("::1").isLocalhost());
+        assertFalse(IPv6Address.valueOf("fff::1").isLocalhost());
     }
-    
-    @Test( expected=IllegalArgumentException.class )
+
+    @Test(expected = IllegalArgumentException.class)
     public void testIllegalLength() {
         IPv6Address.valueOf("0:1:2:3");
     }
-    
-    @Test( expected=IllegalArgumentException.class )
+
+    @Test(expected = IllegalArgumentException.class)
     public void testIllegalLengthPrefix() {
         IPv6Address.valueOf(":1:2:3");
     }
-    
-    @Test( expected=IllegalArgumentException.class )
+
+    @Test(expected = IllegalArgumentException.class)
     public void testIllegalLengthSuffix() {
         IPv6Address.valueOf("1:2:3:");
     }
-    
-    @Test( expected=IllegalArgumentException.class )
+
+    @Test(expected = IllegalArgumentException.class)
     public void testIllegalNumber() {
         IPv6Address.valueOf("::xxx");
     }
-    
+
     @Test
     public void testCompareTo() {
         IPv6Address[] expected = new IPv6Address[]{
-                IPv6Address.valueOf("::"),
-                IPv6Address.valueOf("::1"),
-                IPv6Address.valueOf("::2"),
-                IPv6Address.valueOf("::1:0"),
-                IPv6Address.valueOf("::1:1"),
-                IPv6Address.valueOf("1::")
+            IPv6Address.valueOf("::"),
+            IPv6Address.valueOf("::1"),
+            IPv6Address.valueOf("::2"),
+            IPv6Address.valueOf("::1:0"),
+            IPv6Address.valueOf("::1:1"),
+            IPv6Address.valueOf("1::")
         };
-        
-        IPv6Address[] scrambled = new IPv6Address[]{expected[5], expected[4], expected[3], expected[2],expected[0],expected[1]};
+
+        IPv6Address[] scrambled = new IPv6Address[]{expected[5], expected[4], expected[3], expected[2], expected[0], expected[1]};
         Arrays.sort(scrambled);
-        assertArrayEquals( expected, scrambled );
+        assertArrayEquals(expected, scrambled);
     }
-    
+
     @Test
     public void testLongRoundTrips() {
-        for ( String s: Arrays.asList("a:b:c:d:e:f::1","::","::1","ff:ff:ff:ff:ff:ff:ff:ff",
+        for (String s : Arrays.asList("a:b:c:d:e:f::1", "::", "::1", "ff:ff:ff:ff:ff:ff:ff:ff",
                 "fe80::8358:c945:7094:2e6c",
-                "fe80::60d0:6eff:fece:7713","ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff") ) {
+                "fe80::60d0:6eff:fece:7713", "ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff")) {
             IPv6Address addr = IPv6Address.valueOf(s);
             assertEquals("Bad roundtrip on address: " + s,
                     addr, new IPv6Address(addr.toLongArray()));
         }
     }
-    
+
     @Test
     public void testInclusionAbove() {
-        IPv6Range r = new IPv6Range( IPv6Address.valueOf("dd:2:2:2:2:2:2:2"),
-                                     IPv6Address.valueOf("dd:a:a:a:a:a:a:a"));
-        for ( String addr : Arrays.asList("df:a:a:a:a:a:a:a","dd:b:a:a:a:a:a:a",
-                                            "dd:a:b:a:a:a:a:a","dd:a:a:b:a:a:a:a",
-                                            "dd:a:a:a:b:a:a:a","dd:a:a:a:a:b:a:a",
-                                            "dd:a:a:a:a:a:b:a","dd:a:a:a:a:a:a:b") ) {
+        IPv6Range r = new IPv6Range(IPv6Address.valueOf("dd:2:2:2:2:2:2:2"),
+                IPv6Address.valueOf("dd:a:a:a:a:a:a:a"));
+        for (String addr : Arrays.asList("df:a:a:a:a:a:a:a", "dd:b:a:a:a:a:a:a",
+                "dd:a:b:a:a:a:a:a", "dd:a:a:b:a:a:a:a",
+                "dd:a:a:a:b:a:a:a", "dd:a:a:a:a:b:a:a",
+                "dd:a:a:a:a:a:b:a", "dd:a:a:a:a:a:a:b")) {
             IPv6Address ipv6 = IPv6Address.valueOf(addr);
-        assertFalse( r.contains(ipv6) );
-        assertTrue("for address " + ipv6, above(ipv6.toLongArray(),
-                                                r.getTop().toLongArray()));
-        assertFalse("for address " + ipv6, between(r.getBottom().toLongArray(),
-                                                   r.getTop().toLongArray(),
-                                                   ipv6.toLongArray()));
-        
-    }
-   }
-   
+            assertFalse(r.contains(ipv6));
+            assertTrue("for address " + ipv6, above(ipv6.toLongArray(),
+                    r.getTop().toLongArray()));
+            assertFalse("for address " + ipv6, between(r.getBottom().toLongArray(),
+                    r.getTop().toLongArray(),
+                    ipv6.toLongArray()));
+
+        }
+    }
+
     @Test
     public void testInclusionBelow() {
-        IPv6Range r = new IPv6Range( IPv6Address.valueOf("dd:2:2:2:2:2:2:2"),
-                                     IPv6Address.valueOf("dd:a:a:a:a:a:a:a"));
-        for ( String addr : Arrays.asList("dc:2:2:2:2:2:2:2","dd:1:2:2:2:2:2:2",
-                                          "dd:2:1:2:2:2:2:2","dd:2:2:1:2:2:2:2",
-                                          "dd:2:2:2:1:2:2:2","dd:2:2:2:2:1:2:2",
-                                          "dd:2:2:2:2:2:1:2","dd:2:2:2:2:2:2:1") ) {
+        IPv6Range r = new IPv6Range(IPv6Address.valueOf("dd:2:2:2:2:2:2:2"),
+                IPv6Address.valueOf("dd:a:a:a:a:a:a:a"));
+        for (String addr : Arrays.asList("dc:2:2:2:2:2:2:2", "dd:1:2:2:2:2:2:2",
+                "dd:2:1:2:2:2:2:2", "dd:2:2:1:2:2:2:2",
+                "dd:2:2:2:1:2:2:2", "dd:2:2:2:2:1:2:2",
+                "dd:2:2:2:2:2:1:2", "dd:2:2:2:2:2:2:1")) {
             IPv6Address ipv6 = IPv6Address.valueOf(addr);
-        assertFalse( r.contains(ipv6) );
-        
-        long[] bottomArr = r.getBottom().toLongArray();
-        long[] addrArr = ipv6.toLongArray();
-        
-        assertTrue("for address " + ipv6, above(bottomArr, addrArr));
-        assertFalse("for address " + ipv6, between(bottomArr,
-                                                   r.getTop().toLongArray(), addrArr));
-        
-    }
-   }
-    
+            assertFalse(r.contains(ipv6));
+
+            long[] bottomArr = r.getBottom().toLongArray();
+            long[] addrArr = ipv6.toLongArray();
+
+            assertTrue("for address " + ipv6, above(bottomArr, addrArr));
+            assertFalse("for address " + ipv6, between(bottomArr,
+                    r.getTop().toLongArray(), addrArr));
+
+        }
+    }
+
     @Test
     public void testNetworkInterfaceIgnore() {
-        assertEquals( IPv6Address.valueOf("fe80:0:0:0:0:0:0:1%1]]"),
-                      IPv6Address.valueOf("fe80:0:0:0:0:0:0:1"));
+        assertEquals(IPv6Address.valueOf("fe80:0:0:0:0:0:0:1%1]]"),
+                IPv6Address.valueOf("fe80:0:0:0:0:0:0:1"));
     }
     
-    public boolean above( long[] top, long[] addr ) {
-        return top[0]>addr[0]
-                || ( top[0]==addr[0] && top[1]>addr[1] )
-                || ( top[0]==addr[0] && top[1]==addr[1] && top[2]>addr[2] )
-                || ( top[0]==addr[0] && top[1]==addr[1] && top[2]==addr[2] && top[3]>=addr[3] );
-    }
-   public boolean between( long[] bottom, long[] top, long[] addr ) {
-       return above( top, addr ) && above(addr, bottom);
-   }
+    @Test
+    public void testEquals() {
+        IPv6Address sut = IPv6Address.valueOf("ff:ff:12:23:34::0");
+        assertEquals( sut, sut );
+        assertFalse( sut.equals(null) );
+        assertFalse( sut.equals(IPv4Address.valueOf("12.23.34.54")) );
+        assertFalse( sut.equals(IPv6Address.valueOf("1:2:3:4::0")));
+    }
+
+    public boolean above(long[] top, long[] addr) {
+        return top[0] > addr[0]
+                || (top[0] == addr[0] && top[1] > addr[1])
+                || (top[0] == addr[0] && top[1] == addr[1] && top[2] > addr[2])
+                || (top[0] == addr[0] && top[1] == addr[1] && top[2] == addr[2] && top[3] >= addr[3]);
+    }
+
+    public boolean between(long[] bottom, long[] top, long[] addr) {
+        return above(top, addr) && above(addr, bottom);
+    }
+    
+    
 }
diff --git a/src/test/java/edu/harvard/iq/dataverse/authorization/groups/impl/ipaddress/ip/IpAddressRangeTest.java b/src/test/java/edu/harvard/iq/dataverse/authorization/groups/impl/ipaddress/ip/IpAddressRangeTest.java
index fb255692a53..f232b713640 100644
--- a/src/test/java/edu/harvard/iq/dataverse/authorization/groups/impl/ipaddress/ip/IpAddressRangeTest.java
+++ b/src/test/java/edu/harvard/iq/dataverse/authorization/groups/impl/ipaddress/ip/IpAddressRangeTest.java
@@ -1,11 +1,5 @@
 package edu.harvard.iq.dataverse.authorization.groups.impl.ipaddress.ip;
 
-import edu.harvard.iq.dataverse.authorization.groups.impl.ipaddress.ip.IPv4Range;
-import edu.harvard.iq.dataverse.authorization.groups.impl.ipaddress.ip.IPv6Address;
-import edu.harvard.iq.dataverse.authorization.groups.impl.ipaddress.ip.IPv6Range;
-import edu.harvard.iq.dataverse.authorization.groups.impl.ipaddress.ip.IpAddress;
-import edu.harvard.iq.dataverse.authorization.groups.impl.ipaddress.ip.IPv4Address;
-import edu.harvard.iq.dataverse.authorization.groups.impl.ipaddress.ip.IpAddressRange;
 import org.junit.Test;
 import static org.junit.Assert.*;
 
@@ -78,6 +72,15 @@ public void testIPv4NotApplicable() {
                 );
     }
     
+    @Test
+    public void testSingleAddress() {
+        assertTrue( new IPv4Range( IPv4Address.valueOf("127.5.5.5"), IPv4Address.valueOf("127.5.5.5")).isSingleAddress() );
+        assertFalse( new IPv4Range( IPv4Address.valueOf("17.5.5.5"), IPv4Address.valueOf("127.5.5.5")).isSingleAddress() );
+        
+        assertTrue( new IPv6Range( IPv6Address.valueOf("::1:1"), IPv6Address.valueOf("::1:1")).isSingleAddress() );
+        assertFalse( new IPv6Range( IPv6Address.valueOf("::1:1"), IPv6Address.valueOf("::1:2")).isSingleAddress() );
+    }
+    
     public void testRange( Boolean expected, IpAddressRange range, IpAddress... addresses ) {
         for ( IpAddress ipa : addresses ) {
             assertEquals( "Testing " + ipa + " in " + range, expected, range.contains(ipa));
diff --git a/src/test/java/edu/harvard/iq/dataverse/engine/command/impl/CreateDataverseCommandTest.java b/src/test/java/edu/harvard/iq/dataverse/engine/command/impl/CreateDataverseCommandTest.java
index f429a4f3815..9db03cb7a99 100644
--- a/src/test/java/edu/harvard/iq/dataverse/engine/command/impl/CreateDataverseCommandTest.java
+++ b/src/test/java/edu/harvard/iq/dataverse/engine/command/impl/CreateDataverseCommandTest.java
@@ -201,7 +201,7 @@ public void testDefaultOptions() throws CommandException {
         dv.setCreator(null);
         dv.setDefaultContributorRole(null);
         dv.setOwner( makeDataverse() );
-        final DataverseRequest request = makeRequest();
+        final DataverseRequest request = makeRequest(makeAuthenticatedUser("jk", "rollin'"));
         
         CreateDataverseCommand sut = new CreateDataverseCommand(dv, request, null, null);
         Dataverse result = engine.submit(sut);
diff --git a/src/test/java/edu/harvard/iq/dataverse/engine/command/impl/UpdatePermissionRootCommandTest.java b/src/test/java/edu/harvard/iq/dataverse/engine/command/impl/UpdatePermissionRootCommandTest.java
index f20a45ac751..c60bac05ee8 100644
--- a/src/test/java/edu/harvard/iq/dataverse/engine/command/impl/UpdatePermissionRootCommandTest.java
+++ b/src/test/java/edu/harvard/iq/dataverse/engine/command/impl/UpdatePermissionRootCommandTest.java
@@ -7,24 +7,10 @@
 import edu.harvard.iq.dataverse.engine.TestCommandContext;
 import edu.harvard.iq.dataverse.engine.TestDataverseEngine;
 import edu.harvard.iq.dataverse.engine.command.exception.CommandException;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
 import org.junit.Before;
 import org.junit.Test;
 import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
 
 /**
  *
diff --git a/src/test/java/edu/harvard/iq/dataverse/mocks/MockExplicitGroupService.java b/src/test/java/edu/harvard/iq/dataverse/mocks/MockExplicitGroupService.java
new file mode 100644
index 00000000000..ba64582fc29
--- /dev/null
+++ b/src/test/java/edu/harvard/iq/dataverse/mocks/MockExplicitGroupService.java
@@ -0,0 +1,32 @@
+package edu.harvard.iq.dataverse.mocks;
+
+import edu.harvard.iq.dataverse.authorization.RoleAssignee;
+import edu.harvard.iq.dataverse.authorization.groups.impl.explicit.ExplicitGroup;
+import edu.harvard.iq.dataverse.authorization.groups.impl.explicit.ExplicitGroupServiceBean;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Set;
+import static java.util.stream.Collectors.toSet;
+
+/**
+ *
+ * @author michael
+ */
+public class MockExplicitGroupService extends ExplicitGroupServiceBean {
+    
+    private Map<Long, ExplicitGroup> groups = new HashMap<>();
+    
+    public ExplicitGroup registerGroup( ExplicitGroup grp ) {
+        groups.put(grp.getId(), grp);
+        return grp;
+    }
+
+    @Override
+    public Set<ExplicitGroup> findDirectlyContainingGroups(RoleAssignee ra) {
+        return groups.values().stream()
+                .filter( g -> g.getDirectMembers().contains(ra) )
+                .collect(toSet());
+    }
+    
+    
+}
diff --git a/src/test/java/edu/harvard/iq/dataverse/mocks/MockRoleAssigneeServiceBean.java b/src/test/java/edu/harvard/iq/dataverse/mocks/MockRoleAssigneeServiceBean.java
new file mode 100644
index 00000000000..07ed882a543
--- /dev/null
+++ b/src/test/java/edu/harvard/iq/dataverse/mocks/MockRoleAssigneeServiceBean.java
@@ -0,0 +1,44 @@
+package edu.harvard.iq.dataverse.mocks;
+
+import edu.harvard.iq.dataverse.RoleAssigneeServiceBean;
+import edu.harvard.iq.dataverse.authorization.RoleAssignee;
+import java.util.HashMap;
+import java.util.Map;
+
+/**
+ *
+ * @author michael
+ */
+public class MockRoleAssigneeServiceBean extends RoleAssigneeServiceBean {
+    
+    Map<String, RoleAssignee> assignees = new HashMap<>();
+    
+    public <T extends RoleAssignee> T add (T ra ) {
+        assignees.put(ra.getIdentifier(), ra);
+        return ra;
+    }
+    
+    @Override
+    public RoleAssignee getRoleAssignee(String identifier) {
+        if ( predefinedRoleAssignees.isEmpty() ) {
+            setup();
+        }
+        
+        if (identifier == null || identifier.isEmpty()) {
+            throw new IllegalArgumentException("Identifier cannot be null or empty string.");
+        }
+        switch (identifier.charAt(0)) {
+            case ':':
+                return predefinedRoleAssignees.get(identifier);
+            case '@':
+                return assignees.get(identifier);
+            case '&':
+                return assignees.get(identifier);
+            case '#':
+                throw new IllegalArgumentException("private url users not supported in test - it might be easy to add, though.");
+            default:
+                throw new IllegalArgumentException("Unsupported assignee identifier '" + identifier + "'");
+        }
+    }
+    
+}
diff --git a/src/test/java/edu/harvard/iq/dataverse/mocks/MocksFactory.java b/src/test/java/edu/harvard/iq/dataverse/mocks/MocksFactory.java
index 85995ce37f0..82730f92bbf 100644
--- a/src/test/java/edu/harvard/iq/dataverse/mocks/MocksFactory.java
+++ b/src/test/java/edu/harvard/iq/dataverse/mocks/MocksFactory.java
@@ -13,8 +13,12 @@
 import edu.harvard.iq.dataverse.MetadataBlock;
 import edu.harvard.iq.dataverse.authorization.DataverseRole;
 import edu.harvard.iq.dataverse.authorization.Permission;
+import edu.harvard.iq.dataverse.authorization.groups.impl.explicit.ExplicitGroup;
+import edu.harvard.iq.dataverse.authorization.groups.impl.explicit.ExplicitGroupProvider;
 import edu.harvard.iq.dataverse.authorization.groups.impl.ipaddress.ip.IpAddress;
 import edu.harvard.iq.dataverse.authorization.users.AuthenticatedUser;
+import edu.harvard.iq.dataverse.authorization.users.GuestUser;
+import edu.harvard.iq.dataverse.authorization.users.User;
 import edu.harvard.iq.dataverse.engine.command.DataverseRequest;
 import java.sql.Timestamp;
 import java.time.LocalDate;
@@ -22,7 +26,6 @@
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Date;
-import java.util.HashSet;
 import java.util.LinkedList;
 import java.util.List;
 import java.util.Random;
@@ -98,8 +101,15 @@ public static AuthenticatedUser makeAuthenticatedUser( String firstName, String
         return user;
     }
     
+    /**
+     * @return A request with a guest user.
+     */
     public static DataverseRequest makeRequest() {
-        return new DataverseRequest( makeAuthenticatedUser("Jane", "Doe"), IpAddress.valueOf("215.0.2.17") );
+        return makeRequest( GuestUser.get() );
+    }
+    
+    public static DataverseRequest makeRequest( User u ) {
+        return new DataverseRequest( u, IpAddress.valueOf("1.2.3.4") );
     }
     
     public static Dataverse makeDataverse() {
@@ -210,4 +220,19 @@ public static DataverseFieldTypeInputLevel makeDataverseFieldTypeInputLevel( Dat
         
         return retVal;
     }
+    
+    public static ExplicitGroup makeExplicitGroup( String name, ExplicitGroupProvider prv ) {
+        long id = nextId();
+        ExplicitGroup eg = new ExplicitGroup(prv);
+        
+        eg.setId(id);
+        eg.setDisplayName( name==null ? "explicitGroup-" + id : name );
+        eg.setGroupAliasInOwner("eg" + id);
+        
+        return eg;
+    }
+    
+    public static ExplicitGroup makeExplicitGroup( ExplicitGroupProvider prv ) {
+        return makeExplicitGroup(null, prv);
+    }
 }
diff --git a/src/test/java/edu/harvard/iq/dataverse/util/BitSetTest.java b/src/test/java/edu/harvard/iq/dataverse/util/BitSetTest.java
index f161774ee4b..5aa37e8b05c 100644
--- a/src/test/java/edu/harvard/iq/dataverse/util/BitSetTest.java
+++ b/src/test/java/edu/harvard/iq/dataverse/util/BitSetTest.java
@@ -4,7 +4,9 @@
 
 package edu.harvard.iq.dataverse.util;
 
+import java.util.Arrays;
 import java.util.EnumSet;
+import java.util.List;
 import org.junit.After;
 import org.junit.AfterClass;
 import org.junit.Before;
@@ -53,7 +55,19 @@ public void testSet() {
 			assertTrue( sut.isSet(i) );
 		}
 	}
-
+    
+    @Test
+    public void testSetByParameter() {
+        BitSet tSut = BitSet.emptySet();
+        List<Integer> indices = Arrays.asList(0,1,4,6,7,8,20,31);
+        indices.forEach( i -> assertFalse(tSut.isSet(i)) );
+        indices.forEach( i -> tSut.set(i,true) );
+        indices.forEach( i -> assertTrue(tSut.isSet(i)) );
+        indices.forEach( i -> tSut.set(i,false) );
+        indices.forEach( i -> assertFalse(tSut.isSet(i)) );
+        assertTrue( tSut.isEmpty() );
+    }
+    
 	/**
 	 * Test of unset method, of class BitSet.
 	 */
diff --git a/src/test/java/edu/harvard/iq/dataverse/util/CollectionLiterals.java b/src/test/java/edu/harvard/iq/dataverse/util/CollectionLiterals.java
new file mode 100644
index 00000000000..60f710efbf0
--- /dev/null
+++ b/src/test/java/edu/harvard/iq/dataverse/util/CollectionLiterals.java
@@ -0,0 +1,21 @@
+package edu.harvard.iq.dataverse.util;
+
+import java.util.Arrays;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Set;
+
+/**
+ * 
+ * @author michael
+ */
+public class CollectionLiterals {
+    
+    public static <T> Set<T> setOf( T... args ) {
+        return new HashSet<>(Arrays.asList(args));
+    }
+    
+    public static <T> List<T> listOf( T... args ) {
+        return Arrays.asList(args);
+    }
+}
diff --git a/src/test/java/edu/harvard/iq/dataverse/util/StringUtilTest.java b/src/test/java/edu/harvard/iq/dataverse/util/StringUtilTest.java
index 981005e85b6..3281c23a74f 100644
--- a/src/test/java/edu/harvard/iq/dataverse/util/StringUtilTest.java
+++ b/src/test/java/edu/harvard/iq/dataverse/util/StringUtilTest.java
@@ -113,4 +113,10 @@ public void testHtml2Text() {
         assertEquals(StringUtil.htmlArray2textArray(Arrays.asList("be <b>bold</b>!")), Arrays.asList("be bold!"));
         assertEquals(StringUtil.htmlArray2textArray(null), Collections.emptyList());
     }
+    
+    @Test
+    public void testNullToEmpty() {
+        assertEquals( "hello", StringUtil.nullToEmpty("hello") );
+        assertEquals( "", StringUtil.nullToEmpty(null) );
+    }
 }
diff --git a/src/test/java/edu/harvard/iq/dataverse/util/json/JsonParserTest.java b/src/test/java/edu/harvard/iq/dataverse/util/json/JsonParserTest.java
index 8a6b945a710..ed5a07f1f11 100644
--- a/src/test/java/edu/harvard/iq/dataverse/util/json/JsonParserTest.java
+++ b/src/test/java/edu/harvard/iq/dataverse/util/json/JsonParserTest.java
@@ -14,8 +14,13 @@
 import edu.harvard.iq.dataverse.DatasetFieldValue;
 import edu.harvard.iq.dataverse.DatasetVersion;
 import edu.harvard.iq.dataverse.Dataverse;
-import edu.harvard.iq.dataverse.DataverseTheme;
 import edu.harvard.iq.dataverse.DataverseTheme.Alignment;
+import edu.harvard.iq.dataverse.authorization.groups.impl.ipaddress.IpGroup;
+import edu.harvard.iq.dataverse.authorization.groups.impl.ipaddress.IpGroupProvider;
+import edu.harvard.iq.dataverse.authorization.groups.impl.ipaddress.ip.IpAddress;
+import edu.harvard.iq.dataverse.authorization.groups.impl.ipaddress.ip.IpAddressRange;
+import edu.harvard.iq.dataverse.authorization.users.GuestUser;
+import edu.harvard.iq.dataverse.engine.command.DataverseRequest;
 import edu.harvard.iq.dataverse.settings.SettingsServiceBean;
 import java.io.IOException;
 import java.io.InputStream;
@@ -425,7 +430,92 @@ public void testParseOvercompleteDatasetVersion() throws JsonParseException, IOE
             DatasetVersion actual = sut.parseDatasetVersion(dsJson);
         }
     }
-
+    
+    @Test
+    public void testIpGroupRoundTrip() {
+        
+        IpGroup original = new IpGroup();
+        original.setDescription("Ip group description");
+        original.setDisplayName("Test-ip-group");
+        original.setId(42l);
+        original.setPersistedGroupAlias("test-ip-group");
+        original.setGroupProvider( new IpGroupProvider(null) );
+        
+        original.add( IpAddressRange.make(IpAddress.valueOf("1.2.1.1"), IpAddress.valueOf("1.2.1.10")) );
+        original.add( IpAddressRange.make(IpAddress.valueOf("1.1.1.1"), IpAddress.valueOf("1.1.1.1")) );
+        original.add( IpAddressRange.make(IpAddress.valueOf("1:2:3::4:5"), IpAddress.valueOf("1:2:3::4:5")) );
+        original.add( IpAddressRange.make(IpAddress.valueOf("1:2:3::3:ff"), IpAddress.valueOf("1:2:3::3:5")) );
+        
+        JsonObject serialized = JsonPrinter.json(original).build();
+        
+        System.out.println( serialized.toString() );
+        
+        IpGroup parsed = new JsonParser().parseIpGroup(serialized);
+        
+        assertEquals( original, parsed );
+        
+    }
+    
+    @Test
+    public void testIpGroupRoundTrip_singleIpv4Address() {
+        
+        IpGroup original = new IpGroup();
+        original.setDescription("Ip group description");
+        original.setDisplayName("Test-ip-group");
+        original.setId(42l);
+        original.setPersistedGroupAlias("test-ip-group");
+        original.setGroupProvider( new IpGroupProvider(null) );
+        
+        original.add( IpAddressRange.make(IpAddress.valueOf("1.1.1.1"), IpAddress.valueOf("1.1.1.1")) );
+        
+        JsonObject serialized = JsonPrinter.json(original).build();
+        
+        System.out.println( serialized.toString() );
+        
+        IpGroup parsed = new JsonParser().parseIpGroup(serialized);
+        
+        assertEquals( original, parsed );
+        assertTrue( parsed.contains( new DataverseRequest(GuestUser.get(), IpAddress.valueOf("1.1.1.1")) ));
+        assertFalse( parsed.contains( new DataverseRequest(GuestUser.get(), IpAddress.valueOf("1.1.1.2")) ));
+        assertFalse( parsed.contains( new DataverseRequest(GuestUser.get(), IpAddress.valueOf("1.1.2.1")) ));
+        assertFalse( parsed.contains( new DataverseRequest(GuestUser.get(), IpAddress.valueOf("1.1.1.0")) ));
+        assertFalse( parsed.contains( new DataverseRequest(GuestUser.get(), IpAddress.valueOf("1.1.1.250")) ));
+        assertFalse( parsed.contains( new DataverseRequest(GuestUser.get(), IpAddress.valueOf("1.2.1.1")) ));
+        assertFalse( parsed.contains( new DataverseRequest(GuestUser.get(), IpAddress.valueOf("2.1.1.1")) ));
+        assertFalse( parsed.contains( new DataverseRequest(GuestUser.get(), IpAddress.valueOf("fe80::22c9:d0ff:fe48:ce61")) ));
+        
+    }
+    
+    @Test
+    public void testIpGroupRoundTrip_singleIpv6Address() {
+        
+        IpGroup original = new IpGroup();
+        original.setDescription("Ip group description");
+        original.setDisplayName("Test-ip-group");
+        original.setId(42l);
+        original.setPersistedGroupAlias("test-ip-group");
+        original.setGroupProvider( new IpGroupProvider(null) );
+        
+        original.add( IpAddressRange.make(IpAddress.valueOf("fe80::22c9:d0ff:fe48:ce61"),
+                                          IpAddress.valueOf("fe80::22c9:d0ff:fe48:ce61")) );
+        
+        JsonObject serialized = JsonPrinter.json(original).build();
+        
+        System.out.println( serialized.toString() );
+        
+        IpGroup parsed = new JsonParser().parseIpGroup(serialized);
+        
+        assertEquals( original, parsed );
+        assertTrue( parsed.contains( new DataverseRequest(GuestUser.get(), IpAddress.valueOf("fe80::22c9:d0ff:fe48:ce61")) ));
+        assertFalse( parsed.contains( new DataverseRequest(GuestUser.get(), IpAddress.valueOf("fe80::22c9:d0ff:fe48:ce60")) ));
+        assertFalse( parsed.contains( new DataverseRequest(GuestUser.get(), IpAddress.valueOf("fe80::22c9:d0ff:fe48:ce62")) ));
+        assertFalse( parsed.contains( new DataverseRequest(GuestUser.get(), IpAddress.valueOf("fe80::22c9:d0ff:fe47:ce61")) ));
+        assertFalse( parsed.contains( new DataverseRequest(GuestUser.get(), IpAddress.valueOf("fe80::22c9:d0af:fe48:ce61")) ));
+        assertFalse( parsed.contains( new DataverseRequest(GuestUser.get(), IpAddress.valueOf("fe79::22c9:d0ff:fe48:ce61")) ));
+        assertFalse( parsed.contains( new DataverseRequest(GuestUser.get(), IpAddress.valueOf("2.1.1.1")) ));
+        
+    }
+    
     JsonObject json( String s ) {
         return Json.createReader( new StringReader(s) ).readObject();
     }