diff --git a/core/src/main/java/org/acegisecurity/providers/ldap/populator/DefaultLdapAuthoritiesPopulator.java b/core/src/main/java/org/acegisecurity/providers/ldap/populator/DefaultLdapAuthoritiesPopulator.java index f3a7da3bd5..df7f069267 100644 --- a/core/src/main/java/org/acegisecurity/providers/ldap/populator/DefaultLdapAuthoritiesPopulator.java +++ b/core/src/main/java/org/acegisecurity/providers/ldap/populator/DefaultLdapAuthoritiesPopulator.java @@ -40,8 +40,9 @@ import javax.naming.directory.SearchControls; /** * The default strategy for obtaining user role information from the directory. - *

It obtains roles by performing a search for "groups" the user is a member of. - *

+ * + *

It obtains roles by performing a search for "groups" the user is a member of.

+ * *

A typical group search scenario would be where each group/role is specified using the groupOfNames * (or groupOfUniqueNames) LDAP objectClass and the user's DN is listed in the member (or * uniqueMember) attribute to indicate that they should be assigned that role. The following LDIF sample has @@ -57,8 +58,10 @@ import javax.naming.directory.SearchControls; *

The group search is performed within a DN specified by the groupSearchBase property, which should * be relative to the root DN of its InitialDirContextFactory. If the search base is null, group searching is * disabled. The filter used in the search is defined by the groupSearchFilter property, with the filter - * argument {0} being the full DN of the user. You can also specify which attribute defines the role name by setting + * argument {0} being the full DN of the user. You can also optionally use the parameter {1}, which will be substituted + * with the username. You can also specify which attribute defines the role name by setting * the groupRoleAttribute property (the default is "cn").

+ * *

The configuration below shows how the group search might be performed with the above schema. *

  * <bean id="ldapAuthoritiesPopulator"