In JBoss IDM when you plug LDAP you point groupID for a specific tree part. Then you would refer to configured groupType and simply use the CN part as groupID. Id needs to be unique in scope of groupType so this fits. I think jbpm could allow non constrained ids and just force composite ids for idm integration. then in situation when you plag few different identity stores and map group types to them you need to have some way to discover where they belong anyway. And groupType in composite key allows this. View the original post : http://www.jboss.org/index.html?module=bb&op=viewtopic&p=4237821#... Reply to the post : http://www.jboss.org/index.html?module=bb&op=posting&mode=reply&a...