Index: lams_admin/src/java/org/lamsfoundation/lams/admin/web/UserBean.java
===================================================================
diff -u -r0b201010a3f2d6c762f377e1389657d8c9f67ba1 -r8e72a9a3efd2c5c816da52166aa1929ae87093d2
--- lams_admin/src/java/org/lamsfoundation/lams/admin/web/UserBean.java	(.../UserBean.java)	(revision 0b201010a3f2d6c762f377e1389657d8c9f67ba1)
+++ lams_admin/src/java/org/lamsfoundation/lams/admin/web/UserBean.java	(.../UserBean.java)	(revision 8e72a9a3efd2c5c816da52166aa1929ae87093d2)
@@ -35,6 +35,7 @@
     private Integer userId;
     private String login;
     private String[] roleIds = {};
+    private Boolean memberOfParent;
     
     public Integer getUserId() {
     	return this.userId;
@@ -60,4 +61,12 @@
     	this.roleIds = roleIds;
     }
     
+    public Boolean getMemberOfParent() {
+    	return this.memberOfParent;
+    }
+    
+    public void setMemberOfParent(Boolean memberOfParent) {
+    	this.memberOfParent = memberOfParent;
+    }
+    
 }
Index: lams_admin/src/java/org/lamsfoundation/lams/admin/web/UserOrgRoleAction.java
===================================================================
diff -u -r3d1d6ad7e14e65bf2f8cb8228dde27c94f627a6a -r8e72a9a3efd2c5c816da52166aa1929ae87093d2
--- lams_admin/src/java/org/lamsfoundation/lams/admin/web/UserOrgRoleAction.java	(.../UserOrgRoleAction.java)	(revision 3d1d6ad7e14e65bf2f8cb8228dde27c94f627a6a)
+++ lams_admin/src/java/org/lamsfoundation/lams/admin/web/UserOrgRoleAction.java	(.../UserOrgRoleAction.java)	(revision 8e72a9a3efd2c5c816da52166aa1929ae87093d2)
@@ -40,8 +40,11 @@
 import org.apache.struts.action.ActionForm;
 import org.apache.struts.action.ActionForward;
 import org.apache.struts.action.ActionMapping;
+import org.apache.struts.action.ActionMessage;
+import org.apache.struts.action.ActionMessages;
 import org.apache.struts.action.DynaActionForm;
 import org.lamsfoundation.lams.usermanagement.Organisation;
+import org.lamsfoundation.lams.usermanagement.OrganisationType;
 import org.lamsfoundation.lams.usermanagement.Role;
 import org.lamsfoundation.lams.usermanagement.User;
 import org.lamsfoundation.lams.usermanagement.UserOrganisation;
@@ -77,6 +80,7 @@
             ActionForm form,
             HttpServletRequest request,
             HttpServletResponse response) throws Exception {
+		ActionMessages messages = new ActionMessages();
 		UserOrgRoleForm userOrgRoleForm = (UserOrgRoleForm)form;
 		
 		// set list of roles appropriate for the organisation type
@@ -86,17 +90,28 @@
 		Collections.sort(roles);
 		request.setAttribute("roles",roles);
 		
+		Organisation organisation = (Organisation)getService().findById(Organisation.class, (Integer)request.getAttribute("orgId"));
+		userOrgRoleForm.setOrgId(organisation.getOrganisationId());
+		
 		// populate form with users
 		ArrayList userOrgs = (ArrayList)request.getAttribute("newUserOrganisations");
 		for(int i=0; i<userOrgs.size(); i++){
 			UserBean userBean = new UserBean();
 			User user = ((UserOrganisation)userOrgs.get(i)).getUser();
 			BeanUtils.copyProperties(userBean,user);
+			// flag users that will be added to parent group if necessary
+			if (organisation.getOrganisationType().getOrganisationTypeId().equals(OrganisationType.CLASS_TYPE)) {
+				if (getService().getUserOrganisation(user.getUserId(), organisation.getParentOrganisation().getOrganisationId())==null) {
+					userBean.setMemberOfParent(false);
+				} else {
+					userBean.setMemberOfParent(true);
+				}
+			}
 			userOrgRoleForm.addUserBean(userBean);
+			log.debug("added userbean: "+user.getUserId());
 		}
 		log.debug("userBeans.size: "+userOrgRoleForm.getUserBeans().size());
-		userOrgRoleForm.setOrgId((Integer)request.getAttribute("orgId"));
-		
+
 		return mapping.findForward("userorgrole");		
 	}
 	
Index: lams_admin/src/java/org/lamsfoundation/lams/admin/web/UserOrgRoleSaveAction.java
===================================================================
diff -u -rcc77d96c1c7fb5185915fc4e877cbd02f357364b -r8e72a9a3efd2c5c816da52166aa1929ae87093d2
--- lams_admin/src/java/org/lamsfoundation/lams/admin/web/UserOrgRoleSaveAction.java	(.../UserOrgRoleSaveAction.java)	(revision cc77d96c1c7fb5185915fc4e877cbd02f357364b)
+++ lams_admin/src/java/org/lamsfoundation/lams/admin/web/UserOrgRoleSaveAction.java	(.../UserOrgRoleSaveAction.java)	(revision 8e72a9a3efd2c5c816da52166aa1929ae87093d2)
@@ -37,7 +37,9 @@
 import org.apache.struts.action.ActionForward;
 import org.apache.struts.action.ActionMapping;
 import org.lamsfoundation.lams.usermanagement.Organisation;
+import org.lamsfoundation.lams.usermanagement.OrganisationType;
 import org.lamsfoundation.lams.usermanagement.Role;
+import org.lamsfoundation.lams.usermanagement.User;
 import org.lamsfoundation.lams.usermanagement.UserOrganisation;
 import org.lamsfoundation.lams.usermanagement.UserOrganisationRole;
 import org.lamsfoundation.lams.usermanagement.service.IUserManagementService;
@@ -78,6 +80,7 @@
 		ArrayList userBeans = userOrgRoleForm.getUserBeans();
 		log.debug("userBeans is null? "+userBeans==null);
 		Integer orgId = (Integer)userOrgRoleForm.getOrgId();
+		Organisation organisation = (Organisation)getService().findById(Organisation.class, orgId);
 		request.setAttribute("org",orgId);
 		request.getSession().removeAttribute("UserOrgRoleForm");		
 		if(isCancelled(request)){
@@ -86,26 +89,39 @@
 		
 		log.debug("orgId: "+orgId);
 		
+		// save UserOrganisation memberships, and the associated roles;
+		// for subgroups, if user is not a member of the parent group then add to that as well.
 		for(int i=0; i<userBeans.size(); i++){
 			UserBean bean = (UserBean)userBeans.get(i);
 			log.debug("userId: "+bean.getUserId());
 			String[] roleIds = bean.getRoleIds();
-			UserOrganisation uo = new UserOrganisation(getService().getUserByLogin(bean.getLogin()),(Organisation)getService().findById(Organisation.class, orgId));
-			getService().save(uo);
-			log.debug("added: "+uo.getUser().getUserId());
-			Set uors = new HashSet();
-			for(int j=0; j<roleIds.length; j++) {
-				Role currentRole = (Role)getService().findById(Role.class,new Integer(roleIds[j]));
-				log.debug("setting role: "+currentRole.getRoleId());
-				UserOrganisationRole newUor = new UserOrganisationRole(uo,currentRole);
-				getService().save(newUor);
-				uors.add(newUor);
+			saveRoles(bean.getUserId(), organisation, roleIds);
+			if (organisation.getOrganisationType().getOrganisationTypeId().equals(OrganisationType.CLASS_TYPE)) {
+				if (getService().getUserOrganisation(bean.getUserId(), organisation.getParentOrganisation().getOrganisationId())==null) {
+					saveRoles(bean.getUserId(), organisation.getParentOrganisation(), roleIds);
+				}
 			}
-			uo.setUserOrganisationRoles(uors);
 		}
 		return mapping.findForward("userlist");
 	}
 	
+	private void saveRoles(Integer userId, Organisation organisation, String[] roleIds) {
+		
+		User user = (User)getService().findById(User.class, userId);
+		UserOrganisation uo = new UserOrganisation(user, organisation);
+		getService().save(uo);
+		log.debug("added "+uo.getUser().getLogin()+" to "+uo.getOrganisation().getName());
+		Set uors = new HashSet();
+		for(int j=0; j<roleIds.length; j++) {
+			Role currentRole = (Role)getService().findById(Role.class,new Integer(roleIds[j]));
+			log.debug("setting role: "+currentRole.getName());
+			UserOrganisationRole newUor = new UserOrganisationRole(uo,currentRole);
+			getService().save(newUor);
+			uors.add(newUor);
+		}
+		uo.setUserOrganisationRoles(uors);
+	}
+	
 	private IUserManagementService getService(){
 		if(service==null){
 			WebApplicationContext ctx = WebApplicationContextUtils.getRequiredWebApplicationContext(getServlet().getServletContext());
Index: lams_admin/web/userorgrole.jsp
===================================================================
diff -u -r3d1d6ad7e14e65bf2f8cb8228dde27c94f627a6a -r8e72a9a3efd2c5c816da52166aa1929ae87093d2
--- lams_admin/web/userorgrole.jsp	(.../userorgrole.jsp)	(revision 3d1d6ad7e14e65bf2f8cb8228dde27c94f627a6a)
+++ lams_admin/web/userorgrole.jsp	(.../userorgrole.jsp)	(revision 8e72a9a3efd2c5c816da52166aa1929ae87093d2)
@@ -14,12 +14,12 @@
 }
 </script>
 
-<h2>Assign Roles</h2>
+<h2><fmt:message key="admin.user.assign.roles" /></h2>
+<p>&nbsp;</p>
 
-<div align="center"><html-el:errors/></div>
-
 <html-el:form action="/userorgrolesave.do" method="post">
 <html-el:hidden property="orgId" />
+
 <table class="alternative-color" width=100%>
 <tr>
 	<th><fmt:message key="admin.user.login"/></th>
@@ -34,7 +34,7 @@
 <logic-el:iterate id="userBean" name="UserOrgRoleForm" property="userBeans" indexId="beanIndex">
 	<tr>
 		<td>
-			<c:out value="${userBean.login}" /><br />
+			<c:out value="${userBean.login}" /><c:if test="${!userBean.memberOfParent}"> *<c:set var="parentFlag" value="true" /></c:if>
 		</td>
 		<logic-el:iterate id="role" name="roles">
 			<td>
@@ -51,6 +51,8 @@
 		<html-el:cancel><fmt:message key="admin.cancel"/></html-el:cancel>
 	</td>
 </tr>
-
 </table>
+<c:if test="${parentFlag}">
+<p><fmt:message key="msg.user.add.to.parent.group" /></p>
+</c:if>
 </html-el:form>