We have Tomcat 6 connecting to a Win2k3 Server running AD.

The realm is configured as such

<Realm className="org.apache.catalina.realm.JNDIRealm" debug="99" referrals="follow"
   connectionURL="<url>" 
   connectionName="CN=Query Account,OU=Service Accounts,DC=company,DC=com" 
   connectionPassword="<pwd>" 
   userBase="OU=Users,DC=company,DC=com" userSubtree="true" userSearch="(sAMAccountName={0})" userRoleName="member" 
   roleBase="OU=Security Groups,DC=company,DC=com" roleName="cn" roleSearch="(member={0})" roleSubtree="true"/>

Our groups in AD are such

  Security Groups (OU)
   IT (OU)
     IT Support (OU)
       Support Staff (CN)

The LDAP security works if in the web.xml, I speficy Support Staff. i.e works for Common names.

We want ANY user under Security Groups OU to have access to the application and not just the CN. Tomcat does not search OU's and it just searches CN's in our case. How do we configure our settings so we can do OU level authorization and not just CN level ?

thanks Mat