Meaning of asRdn in AttributeMaping of LdapSecurityRealm is illogicaly different for filtered and simple attributes:

Currently:

• meaning of asRdn is different for mappings without filter (obtaining attribute from identity entry) and with filter (different entry)
  • simple: value of attribute (defined by ldapName) is parsed as DN
  • filtered: DN of the filtered entry is parsed (and ldapName is ignored - even through it is defined)

I suggest:

• when asRdn is defined:
  • if ldapName will be defined, LDAP attribute will be parsed (for filtered mappings too)
  • if ldapName will not be defined, DN of entry will be parsed (DN of identity entry for simple mapping)