There are 3 areas where the LdapLoginModule can be generalized to improve its utility across ldap schemas:

1. Allow the context for the user to be a search criteria that can be a function of the username rather than a specific context DN.

2. Allow the context for the roles to be a search criteria that can be a function of the username rather than a specific context DN.

3. Allow for a mapping from the ldap group to a role name so that the ldap server does not need to know application specific roles.