Dears, I'm trying to configure shiro to authenticate users from AD and to limit access to login to webui for specific group. Here's my shiro.ini config: activeDirectoryRealm = org.apache.zeppelin.server.ActiveDirectoryGroupRealm activeDirectoryRealm.systemUsername = someuser activeDirectoryRealm.systemPassword = somepassword activeDirectoryRealm.searchBase = "OU=x,OU=y,OU=z,DC=,DC=x,DC=x" activeDirectoryRealm.url = ldaps://ldap.domain.com:636 activeDirectoryRealm.groupRolesMap = "CN=HADOOP_GROUP,OU=x,OU=y,OU=z,OU=x,DC=x,DC=x,DC=x":"role1" activeDirectoryRealm.authorizationCachingEnabled = false [roles] role1 = * /api/version = anon #/** = anon /** = authc Currently, authentication works for every user who is in search base, so everyone from search base can login. What I want to achieve is to limit access to specific group so only user which has this group can log in. For testing purposes I created two users. First belongs to group which is listed in groupRolesMap where role1 = * is applied, and the second user belongs to another group, which is not listed in shiro.ini. The problem is that both users can log in, because these users are in the same search base. Is there any way to limit such access? What am I missing? I'll appreciate your help. Kind regards, ... View more