title: Mapping Ldap groups to role of the application in tomcat
body: <p>Need to configure Ldap to tomcat server for authentication and authorization purpose.
          I have declared the realm in serve.xml and i am able to bind the ldap server
          but i need to map the ldap groups to security roles but i am not able to do that
          i have made some configuration in web.xml below for role and group mapping but getting 403 error</p>
  
  <pre><code>&lt;web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
              xmlns="http://java.sun.com/xml/ns/javaee"
              xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
              id="WebApp_ID" version="3.0"&gt;
              &lt;servlet&gt;
                  &lt;servlet-name&gt;TestServlet&lt;/servlet-name&gt;
                  &lt;servlet-class&gt;com.test.TestServlet&lt;/servlet-class&gt;
  
                  &lt;security-role-ref&gt;
                      &lt;role-name&gt;admins&lt;/role-name&gt;
                      &lt;role-link&gt;admins&lt;/role-link&gt;
                  &lt;/security-role-ref&gt;
  
                  &lt;security-role-ref&gt;
                      &lt;role-name&gt;users&lt;/role-name&gt;
                      &lt;role-link&gt;users&lt;/role-link&gt;
                  &lt;/security-role-ref&gt;
  
              &lt;/servlet&gt;
              &lt;servlet-mapping&gt;
                  &lt;servlet-name&gt;TestServlet&lt;/servlet-name&gt;
                  &lt;url-pattern&gt;/test&lt;/url-pattern&gt;
              &lt;/servlet-mapping&gt;
  
              &lt;security-constraint&gt;
                  &lt;web-resource-collection&gt;
                      &lt;web-resource-name&gt;Authentication&lt;/web-resource-name&gt;
                      &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
                      &lt;url-pattern&gt;/test&lt;/url-pattern&gt;
                      &lt;http-method&gt;GET&lt;/http-method&gt;
                      &lt;http-method&gt;POST&lt;/http-method&gt;
                  &lt;/web-resource-collection&gt;
                  &lt;auth-constraint&gt;
                      &lt;role-name&gt;admins&lt;/role-name&gt;
                      &lt;role-name&gt;users&lt;/role-name&gt;
                  &lt;/auth-constraint&gt;
                  &lt;user-data-constraint&gt;
                      &lt;transport-guarantee&gt;NONE&lt;/transport-guarantee&gt;
                  &lt;/user-data-constraint&gt;
              &lt;/security-constraint&gt;
  
              &lt;login-config&gt;
                  &lt;auth-method&gt;BASIC&lt;/auth-method&gt;
              &lt;/login-config&gt;
  
              &lt;security-role&gt;
                  &lt;role-name&gt;admins&lt;/role-name&gt;
              &lt;/security-role&gt;
  
              &lt;security-role&gt;
                  &lt;role-name&gt;users&lt;/role-name&gt;
              &lt;/security-role&gt;
  
  
          &lt;/web-app&gt; 
  
      am missing any configuration for mapping 
  
      realm as below;
      &lt;Realm className="org.apache.catalina.realm.JNDIRealm"
  
                          connectionName="uid=admin,ou=system" connectionPassword="secret" authentication="simple"
  
                          connectionURL="ldap://localhost:10389" userSubtree="true"
  
                          userBase="ou=User,ou=ActiveMQ,ou=system" userSearch="(uid={0})"
  
                          roleBase="ou=Group,ou=ActiveMQ,ou=system" roleName="cn" roleSubtree="true"
  
                          roleSearch="(member={0})" /&gt;
  </code></pre>