title: LDAP to Active Directory on GlassFish works, but still seeing javax.naming.PartialResultException
body: <p>Using GlassFish Server Open Source Edition 3.1.1, thrown the web admin console, I created a security realm (Configurations -> server-config -> Security -> Realms) as follows:</p>
  
  <pre><code>Realm Name: MyLdapRealm
  Class Name: com.sun.enterprise.security.auth.realm.ldap.LDAPRealm
  JAAS Context: ldapRealm
  Directory: ldap://&lt;server&gt;:389
  Base DN: dc=&lt;company&gt;,dc=com
  Assign Groups: Domain Users
  </code></pre>
  
  <p>with the following additional properties</p>
  
  <pre><code>search-bind-dn: &lt;admin&gt;@&lt;company&gt;.com
  search-bind-password: &lt;password&gt;
  search-filter: (&amp;(objectCategory=user)(sAMAccountName=%s))
  group-search-filter: (&amp;(objectCategory=group)(member=%d))
  referrals: follow
  </code></pre>
  
  <p>Then I added the JVM option (Configurations -> server-config -> JVM Settings -> JVM Options):</p>
  
  <pre><code>-Djava.naming.referral=follow
  </code></pre>
  
  <p>My web.xml has</p>
  
  <pre><code>...
  &lt;security-constraint&gt;
      &lt;web-resource-collection&gt;
          &lt;web-resource-name&gt;Security&lt;/web-resource-name&gt;
          &lt;url-pattern&gt;/protected/*&lt;/url-pattern&gt;
          &lt;http-method&gt;GET&lt;/http-method&gt;
          &lt;http-method&gt;POST&lt;/http-method&gt;
      &lt;/web-resource-collection&gt;
      &lt;auth-constraint&gt;
          &lt;role-name&gt;Protected&lt;/role-name&gt;
      &lt;/auth-constraint&gt;
  &lt;/security-constraint&gt;
  &lt;security-role&gt;
      &lt;role-name&gt;Protected&lt;/role-name&gt;
  &lt;/security-role&gt;
  &lt;login-config&gt;
      &lt;auth-method&gt;BASIC&lt;/auth-method&gt;
      &lt;realm-name&gt;MyLdapRealm&lt;/realm-name&gt;
  &lt;/login-config&gt;
  ...
  </code></pre>
  
  <p>And my sun-web.xml has</p>
  
  <pre><code>  ...
    &lt;security-role-mapping&gt;
      &lt;role-name&gt;Protected&lt;/role-name&gt;
      &lt;group-name&gt;Domain Users&lt;/group-name&gt;
    &lt;/security-role-mapping&gt;
    ...
  </code></pre>
  
  <p>When I access any of the pages in the protected path, I get the default login prompt from the browser and I am able to authenticate and view the page. However, my server log shows:</p>
  
  <pre><code>WARNING: SEC1106: Error during LDAP search with filter [(&amp;(objectCategory=group)(member=CN=&lt;name&gt;,OU=&lt;a&gt;,OU=&lt;b&gt;,OU=&lt;c&gt;,dc=&lt;company&gt;,dc=com))].
  WARNING: SEC1000: Caught exception.
  javax.naming.PartialResultException: Unprocessed Continuation Reference(s); remaining name 'dc=&lt;company&gt;,dc=com'
      at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2820)
      at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2794)
      at com.sun.jndi.ldap.LdapNamingEnumeration.getNextBatch(LdapNamingEnumeration.java:129)
      at com.sun.jndi.ldap.LdapNamingEnumeration.hasMoreImpl(LdapNamingEnumeration.java:198)
      at com.sun.jndi.ldap.LdapNamingEnumeration.hasMore(LdapNamingEnumeration.java:171)
      at com.sun.enterprise.security.auth.realm.ldap.LDAPRealm.groupSearch(LDAPRealm.java:702)
      at com.sun.enterprise.security.auth.realm.ldap.LDAPRealm.findAndBind(LDAPRealm.java:497)
      at com.sun.enterprise.security.auth.login.LDAPLoginModule.authenticate(LDAPLoginModule.java:108)
      at com.sun.enterprise.security.auth.login.PasswordLoginModule.authenticateUser(PasswordLoginModule.java:117)
      at com.sun.appserv.security.AppservPasswordLoginModule.login(AppservPasswordLoginModule.java:148)
      at sun.reflect.GeneratedMethodAccessor360.invoke(Unknown Source)
      at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
      at java.lang.reflect.Method.invoke(Method.java:597)
      at javax.security.auth.login.LoginContext.invoke(LoginContext.java:769)
      at javax.security.auth.login.LoginContext.access$000(LoginContext.java:186)
      at javax.security.auth.login.LoginContext$4.run(LoginContext.java:683)
      at java.security.AccessController.doPrivileged(Native Method)
      at javax.security.auth.login.LoginContext.invokePriv(LoginContext.java:680)
      at javax.security.auth.login.LoginContext.login(LoginContext.java:579)
      at com.sun.enterprise.security.auth.login.LoginContextDriver.doPasswordLogin(LoginContextDriver.java:382)
      at com.sun.enterprise.security.auth.login.LoginContextDriver.login(LoginContextDriver.java:240)
      at com.sun.enterprise.security.auth.login.LoginContextDriver.login(LoginContextDriver.java:153)
      at com.sun.web.security.RealmAdapter.authenticate(RealmAdapter.java:512)
      at com.sun.web.security.RealmAdapter.authenticate(RealmAdapter.java:453)
      at org.apache.catalina.authenticator.BasicAuthenticator.authenticate(BasicAuthenticator.java:168)
      at com.sun.web.security.RealmAdapter.invokeAuthenticateDelegate(RealmAdapter.java:1326)
      at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:551)
      at org.apache.catalina.core.StandardPipeline.doInvoke(StandardPipeline.java:623)
      at org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.java:595)
      at com.sun.enterprise.web.WebPipeline.invoke(WebPipeline.java:98)
      at com.sun.enterprise.web.PESessionLockingStandardPipeline.invoke(PESessionLockingStandardPipeline.java:91)
      at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:162)
      at org.apache.catalina.connector.CoyoteAdapter.doService(CoyoteAdapter.java:330)
      at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:231)
      at com.sun.enterprise.v3.services.impl.ContainerMapper.service(ContainerMapper.java:174)
      at com.sun.grizzly.http.ProcessorTask.invokeAdapter(ProcessorTask.java:828)
      at com.sun.grizzly.http.ProcessorTask.doProcess(ProcessorTask.java:725)
      at com.sun.grizzly.http.ProcessorTask.process(ProcessorTask.java:1019)
      at com.sun.grizzly.http.DefaultProtocolFilter.execute(DefaultProtocolFilter.java:225)
      at com.sun.grizzly.DefaultProtocolChain.executeProtocolFilter(DefaultProtocolChain.java:137)
      at com.sun.grizzly.DefaultProtocolChain.execute(DefaultProtocolChain.java:104)
      at com.sun.grizzly.DefaultProtocolChain.execute(DefaultProtocolChain.java:90)
      at com.sun.grizzly.http.HttpProtocolChain.execute(HttpProtocolChain.java:79)
      at com.sun.grizzly.ProtocolChainContextTask.doCall(ProtocolChainContextTask.java:54)
      at com.sun.grizzly.SelectionKeyContextTask.call(SelectionKeyContextTask.java:59)
      at com.sun.grizzly.ContextTask.run(ContextTask.java:71)
      at com.sun.grizzly.util.AbstractThreadPool$Worker.doWork(AbstractThreadPool.java:532)
      at com.sun.grizzly.util.AbstractThreadPool$Worker.run(AbstractThreadPool.java:513)
      at java.lang.Thread.run(Thread.java:619)
  
  WARNING: SEC1106: Error during LDAP search with filter [(&amp;(objectclass=groupofuniquenames)(objectclass=*groupofurls*))].
  WARNING: SEC1000: Caught exception.
  javax.naming.PartialResultException: Unprocessed Continuation Reference(s); remaining name 'dc=&lt;company&gt;,dc=com'
      at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2820)
      at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2794)
      at com.sun.jndi.ldap.LdapCtx.searchAux(LdapCtx.java:1826)
      at com.sun.jndi.ldap.LdapCtx.c_search(LdapCtx.java:1749)
      at com.sun.jndi.toolkit.ctx.ComponentDirContext.p_search(ComponentDirContext.java:368)
      at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.search(PartialCompositeDirContext.java:338)
      at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.search(PartialCompositeDirContext.java:321)
      at javax.naming.directory.InitialDirContext.search(InitialDirContext.java:248)
      at com.sun.enterprise.security.auth.realm.ldap.LDAPRealm.dynamicGroupSearch(LDAPRealm.java:647)
      at com.sun.enterprise.security.auth.realm.ldap.LDAPRealm.findAndBind(LDAPRealm.java:500)
      at com.sun.enterprise.security.auth.login.LDAPLoginModule.authenticate(LDAPLoginModule.java:108)
      at com.sun.enterprise.security.auth.login.PasswordLoginModule.authenticateUser(PasswordLoginModule.java:117)
      at com.sun.appserv.security.AppservPasswordLoginModule.login(AppservPasswordLoginModule.java:148)
      at sun.reflect.GeneratedMethodAccessor360.invoke(Unknown Source)
      at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
      at java.lang.reflect.Method.invoke(Method.java:597)
      at javax.security.auth.login.LoginContext.invoke(LoginContext.java:769)
      at javax.security.auth.login.LoginContext.access$000(LoginContext.java:186)
      at javax.security.auth.login.LoginContext$4.run(LoginContext.java:683)
      at java.security.AccessController.doPrivileged(Native Method)
      at javax.security.auth.login.LoginContext.invokePriv(LoginContext.java:680)
      at javax.security.auth.login.LoginContext.login(LoginContext.java:579)
      at com.sun.enterprise.security.auth.login.LoginContextDriver.doPasswordLogin(LoginContextDriver.java:382)
      at com.sun.enterprise.security.auth.login.LoginContextDriver.login(LoginContextDriver.java:240)
      at com.sun.enterprise.security.auth.login.LoginContextDriver.login(LoginContextDriver.java:153)
      at com.sun.web.security.RealmAdapter.authenticate(RealmAdapter.java:512)
      at com.sun.web.security.RealmAdapter.authenticate(RealmAdapter.java:453)
      at org.apache.catalina.authenticator.BasicAuthenticator.authenticate(BasicAuthenticator.java:168)
      at com.sun.web.security.RealmAdapter.invokeAuthenticateDelegate(RealmAdapter.java:1326)
      at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:551)
      at org.apache.catalina.core.StandardPipeline.doInvoke(StandardPipeline.java:623)
      at org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.java:595)
      at com.sun.enterprise.web.WebPipeline.invoke(WebPipeline.java:98)
      at com.sun.enterprise.web.PESessionLockingStandardPipeline.invoke(PESessionLockingStandardPipeline.java:91)
      at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:162)
      at org.apache.catalina.connector.CoyoteAdapter.doService(CoyoteAdapter.java:330)
      at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:231)
      at com.sun.enterprise.v3.services.impl.ContainerMapper.service(ContainerMapper.java:174)
      at com.sun.grizzly.http.ProcessorTask.invokeAdapter(ProcessorTask.java:828)
      at com.sun.grizzly.http.ProcessorTask.doProcess(ProcessorTask.java:725)
      at com.sun.grizzly.http.ProcessorTask.process(ProcessorTask.java:1019)
      at com.sun.grizzly.http.DefaultProtocolFilter.execute(DefaultProtocolFilter.java:225)
      at com.sun.grizzly.DefaultProtocolChain.executeProtocolFilter(DefaultProtocolChain.java:137)
      at com.sun.grizzly.DefaultProtocolChain.execute(DefaultProtocolChain.java:104)
      at com.sun.grizzly.DefaultProtocolChain.execute(DefaultProtocolChain.java:90)
      at com.sun.grizzly.http.HttpProtocolChain.execute(HttpProtocolChain.java:79)
      at com.sun.grizzly.ProtocolChainContextTask.doCall(ProtocolChainContextTask.java:54)
      at com.sun.grizzly.SelectionKeyContextTask.call(SelectionKeyContextTask.java:59)
      at com.sun.grizzly.ContextTask.run(ContextTask.java:71)
      at com.sun.grizzly.util.AbstractThreadPool$Worker.doWork(AbstractThreadPool.java:532)
      at com.sun.grizzly.util.AbstractThreadPool$Worker.run(AbstractThreadPool.java:513)
      at java.lang.Thread.run(Thread.java:619)
  </code></pre>
  
  <p>Why am I getting this stack trace in the server log? Why does it not recognize that I have the java.naming.referral JVM option set to follow? Any help with this would be greatly appreciated</p>