# Access to group repo grants access to all member repos? **URL:** \ **Category:** Sonatype Nexus Repository\ **Tags:** nexus-repository, group\ **Created:** [August 29, 2022, 5:38pm UTC](https://community.sonatype.com/t/access-to-group-repo-grants-access-to-all-member-repos/9221 "2022-08-29T17:38:00Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![l.beuster](https://yyz1.discourse-cdn.com/flex047/user_avatar/community.sonatype.com/l.beuster/32/2413_2.png) [@l.beuster](https://community.sonatype.com/u/l.beuster)\ **Post date:** [August 29, 2022, 5:38pm UTC](https://community.sonatype.com/t/access-to-group-repo-grants-access-to-all-member-repos/9221/1 "2022-08-29T17:38:00Z")
I’m migrating from artifactory to nexus and just noticed that a simple read access to a group maven repo grants read access to all repos inside this group - even if the member repos are not accessible for the user. This would make privileges completely useless, so I don’t think this is the desired behavior - but what do I miss? My test user only got a read-privilege on the group repo but could download artifacts from the hosted member repo. BTW: In Artifactory these groups work out-of-the-box as I expect… ---
**Author:** ![mpiggott](https://avatars.discourse-cdn.com/v4/letter/m/f0a364/32.png) [@mpiggott](https://community.sonatype.com/u/mpiggott)\ **Post date:** [August 30, 2022, 3:01pm UTC](https://community.sonatype.com/t/access-to-group-repo-grants-access-to-all-member-repos/9221/2 "2022-08-30T15:01:10Z")
This is by design, permissions for the group repository grant access for the user to make requests to content the group provides. Group permissions do not provide access when talking directly to a member repository. ---
**Author:** ![rseddon](https://yyz1.discourse-cdn.com/flex047/user_avatar/community.sonatype.com/rseddon/32/341_2.png) [@rseddon](https://community.sonatype.com/u/rseddon)\ **Post date:** [August 30, 2022, 7:34pm UTC](https://community.sonatype.com/t/access-to-group-repo-grants-access-to-all-member-repos/9221/3 "2022-08-30T19:34:46Z")
You may find this article to be of some help: [https://support.sonatype.com/hc/en-us/articles/221279107-How-can-I-create-private-repositories-in-Nexus-Repository-Manager-](https://support.sonatype.com/hc/en-us/articles/221279107-How-can-I-create-private-repositories-in-Nexus-Repository-Manager-) It was written for Nexus Repo 2, but the principles are the same for 3. ---
**Author:** ![l.beuster](https://yyz1.discourse-cdn.com/flex047/user_avatar/community.sonatype.com/l.beuster/32/2413_2.png) [@l.beuster](https://community.sonatype.com/u/l.beuster)\ **Post date:** [August 30, 2022, 7:56pm UTC](https://community.sonatype.com/t/access-to-group-repo-grants-access-to-all-member-repos/9221/4 "2022-08-30T19:56:02Z")
Thanks for the clarification about group permissions. For me it’s a little bit unusual since this involves somehow group-repos in the permission model. Maybe you could explicitly document this somewhere. ---
**Author:** ![l.beuster](https://yyz1.discourse-cdn.com/flex047/user_avatar/community.sonatype.com/l.beuster/32/2413_2.png) [@l.beuster](https://community.sonatype.com/u/l.beuster)\ **Post date:** [August 30, 2022, 8:08pm UTC](https://community.sonatype.com/t/access-to-group-repo-grants-access-to-all-member-repos/9221/5 "2022-08-30T20:08:24Z")
This article a few hours earlier would have saved me some time 😉 But I did it exactly like this: deny company artifacts on the group repo and activate the sub paths for teams. It works, but makes permissions quite complex because the content selectors for read access depend on string _patterns_. And I had to mix content selectors for read and repo views for write. Seems to me a little bit complex for a common use case, but it works. The solution with the different team groups doesn’t work very well if a user is in several groups because there’s no fixed url.