The is a bug in the class org.jboss.security.auth.spi.LdapLoginModule whereby once the user is authenticated, it assigns all roles listed under the role context DN to the user.

The following patch fixes the problem. Please apply it to future releases:

— jboss-4.0.3SP1-src/security/src/main/org/jboss/security/auth/spi/LdapLoginModule.java 2005-08-30 06:23:07.000000000 +1000
+++ jboss-4.0.3SP1-src-new/security/src/main/org/jboss/security/auth/spi/LdapLoginModule.java 2005-11-19 22:30:27.000000000 +1100
@@ -329,7 +329,7 @@
roleAttrName = "roles";
StringBuffer roleFilter = new StringBuffer("(");
roleFilter.append(uidAttrName);

• roleFilter.append("=*)");
  + roleFilter.append("= {0}

  )");
  //BasicAttributes matchAttrs = new BasicAttributes(true);
  String userToMatch = username;
  if (matchOnUserDN == true)