title: WSO2 Identity Server and Active Directory Integration
body: <p>So I've been playing and toying with WSO2 Identity Server for a while and I have to say it hurts me more than it helps. Anyway, I have question on how to integrate with Active Directory. I've got to a point where I can see all my AD's Users and Groups in WSO2 IS. However, I encountered the following:</p>
  
  <ul>
  <li>I can't login to WSO2 IS with any AD credential.</li>
  <li>I can't configure domain (foo.com\) for AD users in WSO2.</li>
  <li>When I login to WSO2 with admin, I see all AD users but they don't have any Roles (Groups). Somehow when WSO2 read these Users from AD, it doesn't read the AD Group the Users belong to.</li>
  </ul>
  
  <p>My long and boring WSO2 IS configuration:</p>
  
  <pre><code>&lt;UserManager&gt;
    &lt;Realm&gt;
      &lt;Configuration&gt;
        &lt;AdminRole&gt;admin&lt;/AdminRole&gt;
        &lt;AdminUser&gt;
          &lt;UserName&gt;admin&lt;/UserName&gt;
          &lt;Password&gt;admin&lt;/Password&gt;
        &lt;/AdminUser&gt;
        &lt;EveryOneRoleName&gt;everyone&lt;/EveryOneRoleName&gt;
        &lt;!-- By default users in this role sees the registry root --&gt;
        &lt;Property name="dataSource"&gt;jdbc/WSO2CarbonDB&lt;/Property&gt;
        &lt;Property name="MultiTenantRealmConfigBuilder"&gt;org.wso2.carbon.user.core.config.multitenancy.CommonLDAPRealmConfigBuilder&lt;/Property&gt;
      &lt;/Configuration&gt;
  
      &lt;UserStoreManager class="org.wso2.carbon.user.core.ldap.ReadWriteLDAPUserStoreManager"&gt;
        &lt;Property name="defaultRealmName"&gt;WSO2.ORG&lt;/Property&gt;
        &lt;Property name="kdcEnabled"&gt;false&lt;/Property&gt;
        &lt;Property name="ConnectionURL"&gt;ldap://localhost:${Ports.EmbeddedLDAP.LDAPServerPort}&lt;/Property&gt;
        &lt;Property name="ConnectionName"&gt;uid=admin,ou=system&lt;/Property&gt;
        &lt;Property name="ConnectionPassword"&gt;admin&lt;/Property&gt;
        &lt;Property name="passwordHashMethod"&gt;SHA&lt;/Property&gt;
        &lt;Property name="UserNameListFilter"&gt;(objectClass=person)&lt;/Property&gt;
        &lt;Property name="UserEntryObjectClass"&gt;identityPerson&lt;/Property&gt;
        &lt;Property name="UserSearchBase"&gt;ou=Users,dc=wso2,dc=org&lt;/Property&gt;
        &lt;Property name="UserNameSearchFilter"&gt;(&amp;amp;(objectClass=person)(uid=?))&lt;/Property&gt;
        &lt;Property name="UserNameAttribute"&gt;uid&lt;/Property&gt;
        &lt;Property name="PasswordJavaScriptRegEx"&gt;^[\\S]{5,30}$&lt;/Property&gt;
        &lt;Property name="ServicePasswordJavaRegEx"&gt;^[\\S]{5,30}$&lt;/Property&gt;
        &lt;Property name="ServiceNameJavaRegEx"&gt;^[\\S]{2,30}/[\\S]{2,30}$&lt;/Property&gt;
        &lt;Property name="UsernameJavaScriptRegEx"&gt;^[\\S]{3,30}$&lt;/Property&gt;
        &lt;Property name="UsernameJavaRegEx"&gt;[a-zA-Z0-9._-|//]{3,30}$&lt;/Property&gt;
        &lt;Property name="RolenameJavaScriptRegEx"&gt;^[\\S]{3,30}$&lt;/Property&gt;
        &lt;Property name="RolenameJavaRegEx"&gt;[a-zA-Z0-9._-|//]{3,30}$&lt;/Property&gt;
        &lt;Property name="ReadLDAPGroups"&gt;true&lt;/Property&gt;
        &lt;Property name="WriteLDAPGroups"&gt;true&lt;/Property&gt;
        &lt;Property name="EmptyRolesAllowed"&gt;true&lt;/Property&gt;
        &lt;Property name="GroupSearchBase"&gt;ou=Groups,dc=wso2,dc=org&lt;/Property&gt;
        &lt;Property name="GroupNameListFilter"&gt;(objectClass=groupOfNames)&lt;/Property&gt;
        &lt;Property name="GroupEntryObjectClass"&gt;groupOfNames&lt;/Property&gt;
        &lt;Property name="GroupNameSearchFilter"&gt;(&amp;amp;(objectClass=groupOfNames)(cn=?))&lt;/Property&gt;
        &lt;Property name="GroupNameAttribute"&gt;cn&lt;/Property&gt;
        &lt;Property name="MembershipAttribute"&gt;member&lt;/Property&gt;
        &lt;Property name="UserRolesCacheEnabled"&gt;true&lt;/Property&gt;
        &lt;Property name="UserDNPattern"&gt;uid={0},ou=Users,dc=wso2,dc=org&lt;/Property&gt;
        &lt;Property name="SCIMEnabled"&gt;true&lt;/Property&gt;
        &lt;Property name="maxFailedLoginAttempt"&gt;0&lt;/Property&gt;
      &lt;/UserStoreManager&gt;
  
      &lt;UserStoreManager class="org.wso2.carbon.user.core.ldap.ReadOnlyLDAPUserStoreManager"&gt;
        &lt;Property name="ReadOnly"&gt;true&lt;/Property&gt;
        &lt;Property name="MaxUserNameListLength"&gt;100&lt;/Property&gt;
        &lt;Property name="ConnectionURL"&gt;ldap://10.10.10.72:389&lt;/Property&gt;
        &lt;Property name="ConnectionName"&gt;CN=Firstname Lastname,OU=Users,OU=New York,OU=Offices,DC=foo,DC=bar,DC=com&lt;/Property&gt;
        &lt;Property name="ConnectionPassword"&gt;Password1*&lt;/Property&gt;
        &lt;Property name="passwordHashMethod"&gt;SHA&lt;/Property&gt;
        &lt;Property name="UserSearchBase"&gt;ou=Users,dc=wso2,dc=org&lt;/Property&gt;
        &lt;Property name="UserNameListFilter"&gt;(objectClass=person)&lt;/Property&gt;
        &lt;Property name="UserNameAttribute"&gt;sAMAccountName&lt;/Property&gt;
        &lt;Property name="ReadLDAPGroups"&gt;false&lt;/Property&gt;
        &lt;Property name="GroupSearchBase"&gt;ou=Groups,dc=wso2,dc=org&lt;/Property&gt;
        &lt;Property name="GroupNameListFilter"&gt;(objectClass=groupOfNames)&lt;/Property&gt;
        &lt;Property name="GroupNameAttribute"&gt;cn&lt;/Property&gt;
        &lt;Property name="MembershipAttribute"&gt;member&lt;/Property&gt;
        &lt;Property name="UserRolesCacheEnabled"&gt;true&lt;/Property&gt;
        &lt;Property name="ReplaceEscapeCharactersAtUserLogin"&gt;true&lt;/Property&gt;
        &lt;Property name="maxFailedLoginAttempt"&gt;0&lt;/Property&gt;
        &lt;!--Property name="DomainName"&gt;foo.com&lt;/Property--&gt;
      &lt;/UserStoreManager&gt;
  
      &lt;UserStoreManager class="org.wso2.carbon.user.core.ldap.ActiveDirectoryUserStoreManager"&gt;
        &lt;Property name="defaultRealmName"&gt;NYSTSTest&lt;/Property&gt;
        &lt;Property name="kdcEnabled"&gt;false&lt;/Property&gt;
        &lt;Property name="ConnectionURL"&gt;ldap://10.10.10.72:389&lt;/Property&gt;
        &lt;Property name="ConnectionName"&gt;CN=Firstname Lastname,OU=Users,OU=New York,OU=Offices,DC=foo,DC=bar,DC=com&lt;/Property&gt;
        &lt;Property name="ConnectionPassword"&gt;Password1*&lt;/Property&gt;
        &lt;Property name="passwordHashMethod"&gt;PLAIN_TEXT&lt;/Property&gt;
        &lt;Property name="UserSearchBase"&gt;OU=Users,OU=New York,OU=Offices,DC=foo,DC=bar,DC=com&lt;/Property&gt;
        &lt;Property name="UserEntryObjectClass"&gt;person&lt;/Property&gt;
        &lt;Property name="UserNameAttribute"&gt;sAMAccountName&lt;/Property&gt;
        &lt;Property name="isADLDSRole"&gt;false&lt;/Property&gt;
        &lt;Property name="userAccountControl"&gt;512&lt;/Property&gt;
        &lt;Property name="UserNameListFilter"&gt;(objectClass=person)&lt;/Property&gt;
        &lt;Property name="UserNameSearchFilter"&gt;(&amp;amp;(objectClass=user)(cn=?))&lt;/Property&gt;
        &lt;Property name="UsernameJavaRegEx"&gt;[a-zA-Z0-9._-|//]{3,30}$&lt;/Property&gt;
        &lt;Property name="UsernameJavaScriptRegEx"&gt;^[\\S]{3,30}$&lt;/Property&gt;
        &lt;Property name="PasswordJavaScriptRegEx"&gt;^[\\S]{5,30}$&lt;/Property&gt;
        &lt;Property name="RolenameJavaScriptRegEx"&gt;^[\\S]{3,30}$&lt;/Property&gt;
        &lt;Property name="RolenameJavaRegEx"&gt;[a-zA-Z0-9._-|//]{3,30}$&lt;/Property&gt;
        &lt;Property name="ReadLDAPGroups"&gt;true&lt;/Property&gt;
        &lt;Property name="WriteLDAPGroups"&gt;false&lt;/Property&gt;
        &lt;Property name="EmptyRolesAllowed"&gt;true&lt;/Property&gt;
        &lt;Property name="GroupSearchBase"&gt;OU=Groups,OU=New York,OU=Offices,DC=foo,DC=bar,DC=com&lt;/Property&gt;
        &lt;Property name="GroupEntryObjectClass"&gt;group&lt;/Property&gt;
        &lt;Property name="GroupNameAttribute"&gt;sAMAccountName&lt;/Property&gt;
        &lt;Property name="MembershipAttribute"&gt;member&lt;/Property&gt;
        &lt;Property name="GroupNameListFilter"&gt;(objectCategory=group)&lt;/Property&gt;
        &lt;Property name="GroupNameSearchFilter"&gt;(&amp;amp;(objectClass=group)(cn=?))&lt;/Property&gt;
        &lt;Property name="UserRolesCacheEnabled"&gt;true&lt;/Property&gt;
        &lt;!--Property name="Referral"&gt;follow&lt;/Property--&gt;
        &lt;Property name="BackLinksEnabled"&gt;false&lt;/Property&gt;
        &lt;Property name="maxFailedLoginAttempt"&gt;0&lt;/Property&gt;
        &lt;!--Property name="DomainName"&gt;foo.com&lt;/Property--&gt;
      &lt;/UserStoreManager&gt;
  
      &lt;AuthorizationManager
              class="org.wso2.carbon.user.core.authorization.JDBCAuthorizationManager"&gt;
        &lt;Property name="AdminRoleManagementPermissions"&gt;/permission&lt;/Property&gt;
        &lt;Property name="AuthorizationCacheEnabled"&gt;true&lt;/Property&gt;
      &lt;/AuthorizationManager&gt;
    &lt;/Realm&gt;
  &lt;/UserManager&gt;
  </code></pre>