# Groups

The groups of the router's directory, with their descriptions and members.

- **Add** and **Edit:** the name, the description and the members in one dialog. A group has at
  least one member: a user or a service account, but not an internal one.
- **Remove:** removes the group; its members are kept, and it is taken out of the roles assigned
  to it. A group that a client of the [OpenID Provider](service-accounts.md#openid-provider) allows
  cannot be removed.

## Groups the router reads

- **admins:** its members use all pages of the Manager. Only root on the router changes it, with
  `vpn-router-group` or a token of `vpn-router-token`.
- **Allowed groups** of an OpenID Connect client: only their members may sign in to that client.
  Renaming a group renames it in those clients.
- **Roles** of a resource of the OpenID Provider assigned to a group are roles of its members, in
  the tokens for that resource. Renaming a group renames it in those roles.