jbossas/jboss-as — pull request #3170 by fharms (2012-10-03 14:41:44+00:00)
Title: [AS7-4807] add support for ldap authorization

This feature support 2 modes for retrieving user roles from LDAP.

- Where the users membership is stored on role/group entries, filter on all roles/groups entries the user is member of. The full distinguished name of the role is always returned by default, however you have the possibility to scrub the result before it's added to the subject.
- Where the users membership is stored on the user object it self. This is the far most efficient way of retrieving roles, but not all LDAP services provide "Reverse Group Membership Maintenance". The returned name of the role is depend on the attribute on the role filter and the same goes here you have the possibility to scrub the result.

LDAP roles/groups is typical a distinguished name combined by multiple DN and if the common name it not suitable as role name, it possible to parse the result with regular expression and cut into groups and concatenate them in different order.

Attributes on the role-filter :
* attribute = the name of the attribute that store the name of the role
* pattern = "=([^,]+)" is the regular expression for grouping the result. if a pattern is specified it will by default will return group(0)
* group = "1" when the result is represented in multiple groups you can specify which group to return, by default it always group(0)
* result-pattern = "{0}-{2}" if you want to concatenate them in different order. you can use the result-pattern. the keyword {0} through {9} represent the row number in the group. one keyword shall always be present
* reverse-group = true if the members is stored on the user object it self
* username-attribute = the LDAP attribute that store the username on the user object.

This example the name of the role is "cn=guest,ou=groups,dc=jboss,dc=com" and the role that is added to the subject is "guest-jboss" based of the pattern, group and result-pattern

```

```