[ https://issues.jboss.org/browse/WFCORE-1281?page=com.atlassian.jira.plugi... ] Ondrej Lukas updated WFCORE-1281: --------------------------------- Steps to Reproduce: 1) use following security realm: {code:xml} <security-realm name="ldap-security-realm"> <authentication> <ldap connection="ldap_connection" base-dn="dc=jboss,dc=org" recursive="true"> <username-filter attribute="uid"/> </ldap> </authentication> <authorization> <ldap connection="ldap_connection"> <group-search group-name="SIMPLE" iterative="false" group-dn-attribute="dn" group-name-attribute="description"> <principal-to-group group-attribute="sn"/> </group-search> </ldap> </authorization> </security-realm> {code} ... {code:xml} <outbound-connections> <ldap name="ldap_connection" url="ldap://localhost:10389" search-dn="uid=admin,ou=system" search-credential="secret"/> </outbound-connections> {code} 2) Use this security domain for RBAC access to management console: {code:xml} <management-interfaces> <native-interface security-realm="ManagementRealm"> <socket-binding native="management-native"/> </native-interface> <http-interface security-realm="ldap-security-realm"> <socket-binding http="management-http"/> </http-interface> </management-interfaces> <access-control provider="rbac"> <role-mapping> <role name="SuperUser"> <include> <user name="$local"/> <group name="JBossAdmin"/> </include> </role> </role-mapping> </access-control> {code} 3) Use ldap server with attached ldif 4) Try to access management console with jduke/Password - it will fail. 5) Uncomment line 'description: Monitor' from ldif and try to access management console again - it will be successful. was: 1) use following security domain: {code:xml} <security-realm name="ldap-security-realm"> <authentication> <ldap connection="ldap_connection" base-dn="dc=jboss,dc=org" recursive="true"> <username-filter attribute="uid"/> </ldap> </authentication> <authorization> <ldap connection="ldap_connection"> <group-search group-name="SIMPLE" iterative="false" group-dn-attribute="dn" group-name-attribute="description"> <principal-to-group group-attribute="sn"/> </group-search> </ldap> </authorization> </security-realm> {code} ... {code:xml} <outbound-connections> <ldap name="ldap_connection" url="ldap://localhost:10389" search-dn="uid=admin,ou=system" search-credential="secret"/> </outbound-connections> {code} 2) Use this security domain for RBAC access to management console: {code:xml} <management-interfaces> <native-interface security-realm="ManagementRealm"> <socket-binding native="management-native"/> </native-interface> <http-interface security-realm="ldap-security-realm"> <socket-binding http="management-http"/> </http-interface> </management-interfaces> <access-control provider="rbac"> <role-mapping> <role name="SuperUser"> <include> <user name="$local"/> <group name="JBossAdmin"/> </include> </role> </role-mapping> </access-control> {code} 3) Use ldap server with attached ldif 4) Try to access management console with jduke/Password - it will fail. 5) Uncomment line 'description: Monitor' from ldif and try to access management console again - it will be successful. -- This message was sent by Atlassian JIRA (v6.4.11#64026)