title: ldap.rememberMe.usernameMapper.userDnBase (multiple instances of?) (searchSubtree search capability)
body: <p>I have a Grails application that is successfully using the latest <strong><em>spring-security-core:2.0-RC4</em></strong> and <strong><em>spring-security-ldap:2.0-RC2</em></strong>. Users can login perfectly using
  <strong><em>grails.plugin.springsecurity.ldap.search.base</em></strong> setting for LDAP login authentication.</p>
  
  <p>There is a different setting for the rememberMe <em>userDnBase</em> (mapper) and that setting is:
  <strong><em>grails.plugin.springsecurity.ldap.rememberMe.usernameMapper.userDnBase</em></strong></p>
  
  <p>The LDAP authentication <strong><em>grails.plugin.springsecurity.ldap.search.base</em></strong> is set to <strong><em>ou=people,dc=sitcudy,dc=edu</em></strong>. As mentioned above - the logins work fine because there is a property called <strong><em>searchSubtree</em></strong> that I have set to true. Unfortunately, the <strong><em>searchSubtree</em></strong> setting does not hold true and carry through consistently within the 'remember-me' portion of the code <strong><em>(.ldap.rememberMe</em>)*</strong>. The remember-me portion of the code uses a map for the base DN,  <strong><em>grails.plugin.springsecurity.ldap.rememberMe.usernameMapper.userDnBase</em></strong>
   so I put in a string in the <strong><em>config.groovy</em></strong> file (the same as for the authentication piece) to map to the base DN of <strong><em>ou=people,dc=sitcudy,dc=edu</em></strong>.... which gets mapped to the DN for the LDAP user look up upon returning to the application for persistence cookie login.</p>
  
  <p>Here's where my problem comes in, most users are segregated into different DIT's in our LDAP system. For example, some uses are in <strong><em>ou=staff,ou=people,dc=sitcudy,dc=edu</em></strong> while other users are in <strong><em>ou=students,ou=people,dc=sitcudy,dc=edu</em></strong> therefore, because of the remember me mapping, upon returning to the application, once verifying the cookie, the code tries to bind users in this format, <strong><em>uid=reuben_marcus,ou=people,dc=sitcudy,dc=edu</em></strong> which doesn't exist. What does exist is <strong><em>uid=reuben_marcus,ou=staff,ou=people,dc=sitcudy,dc=edu</em></strong> therefore the cookie is destroyed and the login (<strong><em>IS_AUTHENTICATED_REMEMBERED</em></strong>) never occurs.</p>
  
  <p>If I change <strong><em>grails.plugin.springsecurity.ldap.rememberMe.usernameMapper.userDnBase</em></strong>
   to <strong><em>ou=staff,ou=people,dc=sitcudy,dc=edu</em></strong> the remember me functionality works perfect for all staff members, but it doesn't work for all other people - students, faculty etc.</p>
  
  <p>The main setting in question below for me in this issue is:
  <strong><em>grails.plugin.springsecurity.ldap.rememberMe.usernameMapper.userDnBase</em></strong></p>
  
  <p>Since this is just a mapping and there isn't allowance for multiple <strong><em>userDNBases</em></strong> or <strong><em>searchSubtree</em></strong> search.. <strong>How is the ‘remember-me’ code supposed to find users that do not fall into this base DN setting...??</strong></p>
  
  <p>I wonder if I'm doing something wrong or if this is a feature request to have the ‘remember me’ code have options for multiple mapping <strong><em>userDNBases</em></strong> or allow it to have a <strong><em>searchSubtree</em></strong> search capability.</p>
  
  <p>Relevant settings from my config.groovy:</p>
  
  <pre><code>grails.plugin.springsecurity.ldap.mapper.roleAttributes = 'sitPriRole,uid'
  grails.plugin.springsecurity.ldap.context.managerDn = 'uid=SPS_bind,ou=People,dc=sitcudy,dc=edu'
  grails.plugin.springsecurity.ldap.context.managerPassword = 'xxx' 
  grails.plugin.springsecurity.ldap.context.server = 'ldap://ds01.sitcudy.edu:389'
  grails.plugin.springsecurity.ldap.authorities.groupSearchBase ='ou=Groups,dc=sitcudy,dc=edu' 
  
  
  grails.plugin.springsecurity.ldap.search.base = 'ou=People,dc=sitcudy,dc=edu'
  grails.plugin.springsecurity.ldap.search.searchSubtree = true
  grails.plugin.springsecurity.ldap.auth.hideUserNotFoundExceptions = false
  grails.plugin.springsecurity.ldap.search.attributesToReturn = ['uid', 'sitPriRole', 'mail', 'displayName']
  grails.plugin.springsecurity.providerNames = ['ldapAuthProvider', 'anonymousAuthenticationProvider', 'rememberMeAuthenticationProvider']
  grails.plugin.springsecurity.ldap.authorities.retrieveGroupRoles = false
  grails.plugin.springsecurity.ldap.authorities.retrieveDatabaseRoles = false
  grails.plugin.springsecurity.password.algorithm = 'SHA-256'
  
  
  grails.plugin.springsecurity.rememberMe.persistent = true 
  grails.plugin.springsecurity.rememberMe.persistentToken.domainClassName = 'od.PersistentLogin' 
  
  
  // role-specific LDAP config 
  // grails.plugin.springsecurity.ldap.useRememberMe = true
  grails.plugin.springsecurity.ldap.rememberMe.detailsManager.attributesToRetrieve = null 
  grails.plugin.springsecurity.ldap.rememberMe.detailsManager.groupMemberAttributeName = 'uniquemember'
  grails.plugin.springsecurity.ldap.rememberMe.detailsManager.groupRoleAttributeName = 'cn' 
  grails.plugin.springsecurity.ldap.rememberMe.detailsManager.groupSearchBase = 'ou=Groups,dc=sitcudy,dc=edu'
  grails.plugin.springsecurity.ldap.rememberMe.detailsManager.passwordAttributeName = 'userPassword'
  grails.plugin.springsecurity.ldap.rememberMe.usernameMapper.userDnBase = 'ou=People,dc=sitcudy,dc=edu'
  grails.plugin.springsecurity.ldap.rememberMe.usernameMapper.usernameAttribute = 'uid'
  </code></pre>