title: Getting all ActiveDirectory groups using OpenSSO Client SDK
body: <p>I hope someone here has experience with Sun OpenSSO (now ForgeRock OpenAM).</p>
  
  <p>I'm trying to get all groups in ActiveDirectory using the OpenSSO Client SDK in Java / JBoss EAP 5.0.</p>
  
  <p>I tried the following by combining various samples and code snippets I could find on the web, but this fails and eventually logs "Memberships for identities other than Users is not allowed."   The basic approach was to use AMIdentityRepository -> getRealmIdentity() -> getMemberships(IdType.GROUP) :</p>
  
  <pre><code>SSOTokenManager manager = SSOTokenManager.getInstance();
  String tokenString = URLDecoder.decode(tokenID, "ISO-8859-1");
  SSOToken token = manager.createSSOToken(tokenString);
  if (manager.isValidToken(token)) {
      SSOToken adminToken = (SSOToken)AccessController.
          doPrivileged(AdminTokenAction.getInstance());
   AMIdentityRepository rep = new AMIdentityRepository(adminToken, "/");
   AMIdentity identity = rep.getRealmIdentity();
   Set groups = identity.getMemberships(IdType.GROUP);
  }
  </code></pre>
  
  <p>Note I'm not trying to determine if a user is a member of a group or to retrieve a user's groups - I'm trying to get a list of ALL groups.</p>
  
  <p>Any suggestions would be appreciated - thanks!</p>