title: Recursively query LDAP roles from multiple OUs for a User
body: <p>I am running a Web Application on a WildFly 9.0.2 Server with a Custom Login Realm (which needs to recursively query multiple Organizational Units A for Organizational Units B that are queried from Organizational Units C for a user) that is configured in the standalone.xml like so:</p>
  
  <pre><code>&lt;security-realm name="LoginRealm"&gt;
     &lt;authentication&gt;
         &lt;ldap connection="EC2" base-dn="ou=users,dc=test,dc=de"&gt;
             &lt;username-filter attribute="uid"/&gt;
         &lt;/ldap&gt;
     &lt;/authentication&gt;
  &lt;/security-realm&gt;
  ...
  &lt;security-domain name="other" cache-type="default"&gt;
      &lt;authentication&gt;
          &lt;login-module code="de.test.LoginModule" flag="required"&gt;
              &lt;module-option name="principalDNPrefix" value="uid="/&gt;
              &lt;module-option name="principalDNSuffix" value=",ou=users,dc=test,dc=de"/&gt;
              &lt;module-option name="rolesCtxDN" value="ou=groups,dc=test,dc=de"/&gt;
              &lt;module-option name="roleAttributeID" value="cn"/&gt;
              &lt;module-option name="roleAttributeIsDN" value="false"/&gt;
              ...
  </code></pre>
  
  <p>The user logs in on the website by providing his username (e.g. testA), password (e.g. whatever) and selecting a UserGroup from a dropdown menu (e.g. UserGroupA).
  Then the custom login module (de.test.LoginModule.class) which extends the LdapLoginModule  performs a lookup of the roles by building the principal string by taking the prefix from the standalone xml and adding the suffix after that<br>
  e.g. prefix: <code>uid=</code><br>
  Build by LoginModule: <code>testA,ou=UserGroupA</code><br>
  Suffix: <code>,ou=users,dc=test,dc=de</code><br>
  Resulting in: <code>uid=testA,ou=UserGroupA,ou=users,dc=test,dc=de</code>
  which right now works perfectly. The roles from <code>ou=groups,dc=test,dc=de</code> are retrieved and the security constraints defined in the web.xml with the according roles are executed.</p>
  
  <pre><code>&lt;security-constraint&gt;
      &lt;display-name&gt;Test-Service&lt;/display-name&gt;
      &lt;web-resource-collection&gt;
          &lt;web-resource-name&gt;Test&lt;/web-resource-name&gt;
          &lt;url-pattern&gt;/admin/*&lt;/url-pattern&gt;
          &lt;http-method&gt;GET&lt;/http-method&gt;
          &lt;http-method&gt;POST&lt;/http-method&gt;
      &lt;/web-resource-collection&gt;
      &lt;auth-constraint&gt;
          &lt;description&gt;Only Project Processors may see this&lt;/description&gt;
          &lt;role-name&gt;Project Processor&lt;/role-name&gt;
      &lt;/auth-constraint&gt;      
  &lt;/security-constraint&gt;
  </code></pre>
  
  <p>Now the Organizational Unit "ProjectControlCenter" was added to the LDAP tree structure, which looks like so:</p>
  
  <pre><code>dc=test,dc=de
  |-- ou=applications
  |    |-- ou=ProjectControlCenter
  |    |    |-- ou=permissions
  |    |    |    |-- cn=group.Project Processor.manage
  |    |    |    |-- cn=group.Project Processor.read
  |    |    |    |-- cn=group.Project Monitorer.read
  |    |    |    |-- ...
  |    |    |-- ou=resources
  |    |    |    |-- cn=ProjectControlCenter.Applicaton
  |    |    |    |-- cn=ProjectControlCenter.List
  |    |    |    |-- cn=ProjectControlCenter.System
  |    |    |    |-- ...
  |-- ou=groups
  |    |    |-- cn=Project Processor
  |    |    |-- cn=Project Monitorer
  |    |    |-- ...
  |    |-- ou=users
  |    |    |-- ou=UserGroupA
  |    |    |    |-- uid=testA
  |    |    |    |-- uid=testB
  |    |    |    |-- uid=testC
  |    |    |-- ou=UserGroupB
  |    |    |-- ...
  </code></pre>
  
  <p>Now I need to query not only the roles as the <code>ou=groups,dc=test,dc=de</code> but also all the <code>ou=permissions,ou=ProjectControlCenter,ou=applications,dc=test,dc=de</code> where the assigned roles are a unique member of and add that to the user.
  Furthermore another query would be needed to get all the <code>ou=resources,ou=ProjectControlCenter,ou=applications,dc=test,dc=de</code> where the <code>ou=permissions,ou=ProjectControlCenter,ou=applications,dc=test,dc=de</code> are a unique member of, adding it to the user as well.</p>
  
  <p>So the question is: Is there any way to recursively query all groups for a certain user, permissions for those groups and resources for those permissions through LDAP configurations, or do I need to overload the <code>createLdapInitContext(String username, Object credential)</code> method of the LdapLoginModule.class to achieve the needed queries?</p>