title: Role does not work with (LDAP) Active directory
body: <p>I have successfully installed openkmcommunity edition (Version 6.3.6, Tomcat-8.5.24, PostgeSQL 9.4.15 and Debian 8.2.0)  with MS AD (windows 2012 R2) using advanced configuration and best practices in docs : </p>
  
  <p><a href="https://docs.openkm.com/kcenter/view/okm-6.3-com/active-directory-advanced-configuration.html" rel="nofollow noreferrer">https://docs.openkm.com/kcenter/view/okm-6.3-com/active-directory-advanced-configuration.html</a>
            <a href="https://docs.openkm.com/kcenter/view/okm-6.3-com/ldap-best-practices-for-filtering-users-and-roles.html" rel="nofollow noreferrer">https://docs.openkm.com/kcenter/view/okm-6.3-com/ldap-best-practices-for-filtering-users-and-roles.html</a></p>
  
  <p>But with these docs, I had two problems the user ID was a trigram (sAMAccountName) and the user ID in Role was a First Name and Last Name (CN).
  With the option Principal.ldap.users.from.roles on True, I could see openKm creates users with ID First Name and Last Name (CN).</p>
  
  <p>For one user, I had two accounts: </p>
  
  <pre><code>ID = MLE Name= Mi** Lenormand  Mail= **            Roles = ROLE_USER ROLE_TEST
  
  ID = Mi** Lenormand   Name=Mi** Lenormand   Mail = (empty)   Roles = (empty) 
  </code></pre>
  
  <p>The second account have Roles empty but present in the role (ex: ROLE_USER) when I filter.</p>
  
  <p>I think the problem comes from:</p>
  
  <pre><code>principal.ldap.users.by.role.attribute  member
  principal.ldap.users.by.role.search.base    OU=IT,OU=CDG,OU=SDA,DC=*,DC=**
  principal.ldap.users.by.role.search.filter  (&amp;(objectClass=group)(cn={0}))
  </code></pre>
  
  <p>We can't filter by sAMAccountName because in member there is no sAMAccountName:</p>
  
  <p><a href="https://image.ibb.co/f9MktT/exemple_Forum.png" rel="nofollow noreferrer">https://image.ibb.co/f9MktT/exemple_Forum.png</a></p>
  
  <p>The second problems is role does not work when I logging with MLE. (in Log, I can't logging with ID = Mi** Lenormand)</p>
  
  <p>After many manipulation I have solve the first problem, I am logging with CN and password. But the second problem is always present.</p>
  
  <p>In administration TAB</p>
  
  <pre><code>[code]system.login.lowercase=true
  principal.adapter=com.openkm.principal.LdapPrincipalAdapter
  
  principal.ldap.server=ldap://sd01cdg***:389
  principal.ldap.security.principal=CN=OpenKm,OU=Compte de Service,OU=SDA,DC=***,DC=***
  principal.ldap.security.credentials=*******************
  
  principal.ldap.user.search.base=OU=CDG,OU=SDA,DC=**,DC=**
  principal.ldap.user.search.filter=objectclass=person
  principal.ldap.user.attribute=CN
  
  principal.ldap.role.search.base=OU=CDG,OU=SDA,DC=**,DC=**
  principal.ldap.role.search.filter=(&amp;(objectclass=group)(memberOf=cn=OpenKM_ROLE,ou=cdg,ou=sda,dc=sid,dc=afi))
  principal.ldap.role.attribute=cn
  
  principal.ldap.mail.search.base=OU=CDG,OU=SDA,DC=**,DC=**
  principal.ldap.mail.search.filter=(&amp;(objectClass=person)(cn={0}))
  principal.ldap.mail.attribute=mail
  
  principal.ldap.username.search.base=OU=CDG,OU=SDA,DC=**,DC=**
  principal.ldap.username.search.filter=(&amp;(objectClass=person)(cn={0}))
  principal.ldap.username.attribute=cn
  
  principal.ldap.users.by.role.search.base=OU=CDG,OU=SDA,DC=**,DC=**
  principal.ldap.users.by.role.search.filter=(&amp;(objectClass=group)(cn={0}))
  principal.ldap.users.by.role.attribute=member
  
  principal.ldap.users.from.roles=true 
  
  principal.ldap.roles.by.user.search.base=OU=CDG,OU=SDA,DC=**,DC=**
  principal.ldap.roles.by.user.search.filter=(&amp;(objectClass=person)(cn={0}))
  principal.ldap.roles.by.user.attribute=memberOf
  
  principal.ldap.referral=follow[/code]
  </code></pre>
  
  <p>In [Tomcat-8.5.24]/OpenKM.xml </p>
  
  <pre><code>[code]
  &lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;beans:beans xmlns:beans="http://www.springframework.org/schema/beans"
               xmlns:security="http://www.springframework.org/schema/security"
               xmlns:task="http://www.springframework.org/schema/task"
               xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
               xmlns:amq="http://activemq.apache.org/schema/core"
               xsi:schemaLocation="http://www.springframework.org/schema/beans
                                   http://www.springframework.org/schema/beans/spring-beans.xsd
                                   http://www.springframework.org/schema/security
                                   http://www.springframework.org/schema/security/spring-security.xsd
                                   http://www.springframework.org/schema/task
                                   http://www.springframework.org/schema/task/spring-task.xsd"&gt;
  
  
  &lt;security:authentication-manager alias="authenticationManager"&gt;
       &lt;security:authentication-provider ref="ldapAuthProvider" /&gt;
    &lt;/security:authentication-manager&gt;
  
  &lt;beans:bean id="contextSource" class="org.springframework.security.ldap.DefaultSpringSecurityContextSource"&gt;
    &lt;beans:constructor-arg value="ldap://sd01cdgdc:389"/&gt;
    &lt;beans:property name="userDn" value="CN=OpenKm,OU=Compte de Service,OU=SDA,DC=***,DC=***"/&gt;
    &lt;beans:property name="password" value="******************"/&gt;
    &lt;beans:property name="baseEnvironmentProperties"&gt;
       &lt;beans:map&gt;
          &lt;beans:entry&gt;
            &lt;beans:key&gt;
              &lt;beans:value&gt;java.naming.referral&lt;/beans:value&gt;
            &lt;/beans:key&gt;
            &lt;beans:value&gt;follow&lt;/beans:value&gt;
          &lt;/beans:entry&gt;
        &lt;/beans:map&gt;
     &lt;/beans:property&gt;
  &lt;/beans:bean&gt;
  
  &lt;beans:bean id="ldapAuthProvider" class="org.springframework.security.ldap.authentication.LdapAuthenticationProvider"&gt;
    &lt;beans:constructor-arg&gt;
      &lt;beans:bean class="org.springframework.security.ldap.authentication.BindAuthenticator"&gt;
        &lt;beans:constructor-arg ref="contextSource"/&gt;
        &lt;beans:property name="userSearch" ref="userSearch"/&gt;
      &lt;/beans:bean&gt;
    &lt;/beans:constructor-arg&gt;
    &lt;beans:constructor-arg&gt;
      &lt;beans:bean class="org.springframework.security.ldap.userdetails.DefaultLdapAuthoritiesPopulator"&gt;
        &lt;beans:constructor-arg ref="contextSource"/&gt;
        &lt;beans:constructor-arg value="OU=IT,OU=CDG,OU=SDA,DC=*****,DC=***"/&gt;
        &lt;beans:property name="groupSearchFilter" value="member={0}"/&gt;
        &lt;beans:property name="groupRoleAttribute" value="cn"/&gt;
        &lt;beans:property name="searchSubtree" value="true" /&gt;
        &lt;beans:property name="convertToUpperCase" value="false" /&gt;
       &lt;!-- &lt;beans:property name="rolePrefix" value="ROLE_" /&gt; --&gt;
        &lt;beans:property name="rolePrefix" value="" /&gt;
        &lt;beans:property name="defaultRole" value="ROLE_ADMIN" /&gt;
       &lt;!-- &lt;beans:property name="defaultRole" value="ROLE_USER" /&gt; --&gt;
      &lt;/beans:bean&gt;
    &lt;/beans:constructor-arg&gt;
  &lt;/beans:bean&gt;
  
  &lt;beans:bean id="userSearch" class="org.springframework.security.ldap.search.FilterBasedLdapUserSearch"&gt;
    &lt;beans:constructor-arg index="0" value="OU=CDG,OU=SDA,DC=*****,DC=**" /&gt;
    &lt;beans:constructor-arg index="2" ref="contextSource" /&gt;
  &lt;!--  &lt;beans:constructor-arg index="1" value="sAMAccountName={0}" /&gt; --&gt;
    &lt;beans:constructor-arg index="1" value="CN={0}" /&gt;
    &lt;beans:property name="searchSubtree" value="true" /&gt;
  &lt;/beans:bean&gt;
  
   &lt;/beans:beans&gt;
  [/code]
  </code></pre>
  
  <p>If I don't use <code>&lt;beans:property name="defaultRole" value="ROLE_ADMIN" /&gt;</code>, i can't logging in ROLE_ADMIN</p>
  
  <p>Here are the results that make me think that I'm on the right track: </p>
  
  <p><a href="https://image.ibb.co/nuyODT/Forum1.png" rel="nofollow noreferrer">https://image.ibb.co/nuyODT/Forum1.png</a></p>
  
  <p><a href="https://image.ibb.co/icMAtT/Forum2.png" rel="nofollow noreferrer">https://image.ibb.co/icMAtT/Forum2.png</a></p>
  
  <p><a href="https://image.ibb.co/kguftT/Forum3.png" rel="nofollow noreferrer">https://image.ibb.co/kguftT/Forum3.png</a></p>
  
  <p><a href="https://image.ibb.co/f4p8f8/Forum4.png" rel="nofollow noreferrer">https://image.ibb.co/f4p8f8/Forum4.png</a></p>
  
  <p>Do you have any idea for this problem?</p>