Create an extension of LdapExtLoginModule that can be used with CLIENT-CERT authentication. In the case of SSL authentication, the username maybe a DN format such as (cn=anil,ou=jboss,o=jboss). This login module should be able to parse patterns out of the passed username and use LDAP for role searching.