Currently we need to extend LDAPLoginModule if LDAP server does not maintain GroupID's as one of the user attributes.

It would be nice to have a pluggable group list resolver which could return list of all groups assigned to the given user, this is perticularly
useful where the directory structure maintain Groups and Roles in a seperate hierarchy or even a different domain.