The LdapLoginModule supplies the user with ALL roles from LDAP-server instead of constraining it by the membership.

When LdapLoginModule is seaching for roles for a user, it asks for all roles and not for roles, which have a given user as a member.

The seach code is:

Object[] filterArgs =

;
NamingEnumeration answer = ctx.search(rolesCtxDN, roleFilter.toString(), filterArgs, controls);

where the "roleFilter" is "("uidAttrName"=)". For example it can be (member=). But here:

http://java.sun.com/j2se/1.3/docs/api/javax/naming/directory/InitialDirContext.html#search(java.lang.String,%20javax.naming.directory.Attributes,%20java.lang.String[])

it can be seen, that one have to use "

" and not "*", if it needed to substitute it with "filterArgs"-elements.

I have written my own LdapLoginModule, where only what I changed was this asterisks. It works fine.