Domino LDAP requires the roles to be read from the root context (empty search base).

This fails at the moment because in org.jboss.security.auth.spi.LdapLoginModule, line 28x, there is

if (rolesCtxDN != null)
{
... process roles ...
}

This will not work with an empty rolesCtxDN.

An entry like the following should do the trick, but actually won't work:

login-config.xml/application policy:
<module-option name="rolesCtxDN"></module-option>