Cannot create a group with no members through DAS

Question

I'm using OID 10.1.2.0.2.
It seems that the DAS Self Service Console cannot work with groups with no members:
- When creating a group, it always assigns orcladmin as a member.
- When deleting the last member from a group, an error is shown ("Require at least one user or group member").
- If you create an empty group via other means (e.g. the oidadmin tool), the group will not be visible in the "role assignment" section when creating a new user (even though we enabled that group for role assignment in the "user entry" configuration). After adding one member through the "edit group" page, the role shows up in the role assignment section.
I have a couple of questions regarding this:
1) Is this limitation (group must have at least one member) an ldap or OID limitation, or is it only a DAS or even "self service console" limitation?
2) Why is this limitation there?
3) Is there a way to work around this, i.e. make self service console be able to handle empty groups?
Any help would be greatly appreciated.
Regards,
Johan

Answer 1

I do not agree that a group owner should be a member of that group. For example, I have a group "admins" and a group "analysts". The "admins" group is owner of the "analysts" group, since the users in the "admins" group must be able to create users and assign them to the "analysts" group. However, the "admins" group is not member of the "analysts" group, because I do not want the admins to act as analysts in my application. Ownership of a group (being able to manage it) and membership of a group are two different things. Besides, I also do not understand why the OIDDAS makes the orcladmin user a member of every group that you create there.
Of course, eventually I will have members in my group. But why is it a problem that there are initially no members of a group? I see no reason at all why this would be a problem.
The reason why I ask this is that creating an empty group (initially) is a requirement of my setup process. I am trying to release a clean setup script (with an ldif file) out of development, that our operational department can use to set things up. I want my ldif file to prepare all the necessary groups and owners, but not to create members in those groups (that's the task of the operational people).
However, as soon as I have these empty groups in place, the OIDDAS starts to act strangely (namely, the groups are not visible in the "role assignment" section when creating a user, until there is at least one member in the groups). That's when I found out that the OIDDAS actually does not like having empty groups (error when creating group without members, error when removing last member, ...).
If anyone knows, can you give me one good reason why the OIDDAS does not allow empty groups (or making groups empty)? As far as I can see, the OID/LDAP itself does not have a problem with this (you can create an empty group without any problem via the oidadmin application, or via import of an ldif file).
Thanks,
Johan