Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We are using Cas-Toolbox for our intranet.

We manage to get LDAP attribute via CAS and send it to the intranet app :

<bean id="adAttribRepository" class="">
    <property name="baseDN" value="DC=main,DC=cobaltgroup,DC=com"/>
    <property name="queryTemplate" value="{0}"/>
    <property name="contextSource" ref="contextSource"/>
    <property name="ignorePartialResultException" value="yes"/>
    <property name="usernameAttributeProvider">
        <bean class="">
            <constructor-arg value="sAMAccountName"/>

    <property name="resultAttributeMapping">
        <!-- Mapping beetween LDAP entry's attributes (key) and Principal"s (value) -->
        <entry key="cn" value="Name"/>
        <entry key="mail" value="Email"/>

I want to know if it is possible to get groups the user belongs to. I tried the AD attribute "memberOf", but it returns only "first level" of group membership

Example :

  • User is in groupA
  • groupA is in groupB

MemberOf returns only groupA

I want to get groupA AND groupB

With the following filter, ldapsearch it is easy:


But I don't know how to make it work with CAS-Toolbox

  • Is there a way of creating custom attribute mapping using a LDAP Query ?
  • Is there a constructed AD attribute that already give the right answer ?

Thank in advance for your help

share|improve this question
Do u found any solution to this? – Hons Feb 11 '13 at 11:15

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.