title: spring security and ldap, group-search-filter
body: <p>hi im implementing j2ee with spring security and ldap. </p>
  
  <p>here is my ldap structure:</p>
  
  <pre><code>DIT
   |
   |--Root DSE
          |
          |--dc=apacheLDAP
          |         |
          |         |--ou=roles
          |         |     |
          |         |     |--role=1
          |         |     |--role=2
          |         |     |--role=3   
          |         |
          |         |--ou=users
          |         |     |
          |         |     |--user=ali
          |         |     |--user=john
          |         |     |--user=bettyboop
          |
          |--ou=system
                 |
                 |uid=admin
  </code></pre>
  
  <p>here is the content of my spring security:</p>
  
  <pre><code>&lt;security:authentication-manager&gt;
    &lt;security:ldap-authentication-provider
       user-search-filter="uid={0}"
       user-search-base="ou=user,dc=apacheLDAP"
       group-search-filter="description={0}"
       group-search-base="ou=roles,dc=apacheLDAP"
       group-role-attribute="role"
       role-prefix="ROLE_"
    /&gt;
  &lt;/security:authentication-manager&gt;
  
  &lt;security:ldap-server url="ldap://192.168.1.100:10389"
       manager-dn="uid=admin,ou=system"
       manager-password="secret"
  /&gt;
  </code></pre>
  
  <p>for each role i have a description attribute which has a value of the user-search-filter. so if user ali logs in, the user-search-filter will be uid=ali,ou=users,dc=apacheLDAP. this value will be searched into the role's description attribute. this works fine.</p>
  
  <p>however, i will need to modify the schema by inserting a role attribute into user schema. so the checking of a user role is done in the use schema instead. for example, if ali has role 1 and role 2, his user schema will look like this:</p>
  
  <pre><code>uid    |   ali
  role   |   1
  role   |   2
  </code></pre>
  
  <p>how should i modify spring-security so that checking of authorizaton is done in user schema instead of role schema?</p>