title: Active Directory scanning and role mapping
body: <p>I am running JBPM in JBoss Wildfly 8 and this is configured to use Active Directory Authentication. The configuration is as follows:</p>
  
  <pre><code>&lt;security-domain name="jbpm_ldap_domain"&gt;
      &lt;authentication&gt;
          &lt;login-module code="LdapExtended" flag="required"&gt;
              &lt;module-option name="java.naming.factory.initial" value="com.sun.jndi.ldap.LdapCtxFactory"/&gt;
              &lt;module-option name="java.naming.provider.url" value="ldap://serverIP"/&gt;
              &lt;module-option name="java.naming.security.authentication" value="simple" /&gt;
              &lt;module-option name="bindDN" value="CN=Administrator,CN=Users,DC=domain,DC=com"/&gt;
              &lt;module-option name="bindCredential" value="secretpass"/&gt;
              &lt;module-option name="baseCtxDN" value="OU=MYOU,DC=domain,DC=com"/&gt;
              &lt;module-option name="baseFilter" value="(sAMAccountName={0})"/&gt;
              &lt;module-option name="rolesCtxDN" value="ou=MYOU,dc=domain,dc=com"/&gt;
              &lt;module-option name="roleFilter" value="(member={1})"/&gt;
              &lt;module-option name="roleAttributeID" value="memberOf"/&gt;
              &lt;module-option name="roleAttributeIsDN" value="true"/&gt;
              &lt;module-option name="roleNameAttributeID" value="cn"/&gt;
              &lt;module-option name="allowEmptyPasswords" value="false"/&gt;
              &lt;module-option name="throwValidateError" value="true"/&gt;
          &lt;/login-module&gt;
          &lt;login-module code="RoleMapping" flag="optional"&gt;
              &lt;module-option name="rolesProperties" value="file:${jboss.home.dir}/standalone/configuration/jbpm-roles.properties"/&gt;
              &lt;module-option name="replaceRole" value="true"/&gt;
          &lt;/login-module&gt;
      &lt;/authentication&gt;
  &lt;/security-domain&gt;
  </code></pre>
  
  <p>jbpm-roles.properties:</p>
  
  <pre><code>BPM_ADMIN=admin
  BPM_ANALYST=analyst
  BPM_DEVELOPER=developer
  BPM_USER=user
  BPM_MANAGER=manager
  </code></pre>
  
  <p>So as of now I am scanning a specific OU for roles and user scanning.</p>
  
  <p>I want to do it the following way:</p>
  
  <ol>
  <li>Scan complete domain for users.</li>
  <li>scan role group in an OU.</li>
  <li>user with specific group membership should get admin rights (BPM_ADMIN=admin)</li>
  <li>rest all users should have 'user' role.</li>
  </ol>
  
  <p>I do not want to add all users to a group to give them the <code>user</code> role in JBPM. Instead I want to set the default role as <code>user</code> and if I need to grant <code>admin</code> role I will add the user to the group I have defined for admin users in Active Directory (BPM_ADMIN=admin)</p>
  
  <p>How can this be achieved?</p>