LDAP support: Roles in root context (empty searchBase) not supported

Domino LDAP requires the roles to be read from the root context (empty search base).

This fails at the moment because in org.jboss.security.auth.spi.LdapLoginModule, line 28x, there is

if (rolesCtxDN != null)
{
... process roles ...
}

This will not work with an empty rolesCtxDN.

An entry like the following should do the trick, but actually won't work:

login-config.xml/application policy:
<module-option name="rolesCtxDN"></module-option>