We are using Cas-Toolbox for our intranet.

We manage to get LDAP attribute via CAS and send it to the intranet app :

<bean id="adAttribRepository" class="org.jasig.services.persondir.support.ldap.LdapPersonAttributeDao">
    <property name="baseDN" value="DC=main,DC=cobaltgroup,DC=com"/>
    <property name="queryTemplate" value="{0}"/>
    <property name="contextSource" ref="contextSource"/>
    <property name="ignorePartialResultException" value="yes"/>
    <property name="usernameAttributeProvider">
        <bean class="org.jasig.services.persondir.support.SimpleUsernameAttributeProvider">
            <constructor-arg value="sAMAccountName"/>

    <property name="resultAttributeMapping">
        <!-- Mapping beetween LDAP entry's attributes (key) and Principal"s (value) -->
        <entry key="cn" value="Name"/>
        <entry key="mail" value="Email"/>

I want to know if it is possible to get groups the user belongs to. I tried the AD attribute "memberOf", but it returns only "first level" of group membership

Example :

  • User is in groupA
  • groupA is in groupB

MemberOf returns only groupA

I want to get groupA AND groupB

With the following filter, ldapsearch it is easy:


But I don't know how to make it work with CAS-Toolbox

  • Is there a way of creating custom attribute mapping using a LDAP Query ?
  • Is there a constructed AD attribute that already give the right answer ?

Thank in advance for your help

  • Do u found any solution to this? – Hons Feb 11 '13 at 11:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.