LDAP authorization problem in OC4J 10.1.3. using OID

Question

I'm attempting to secure a j2ee application using OID and SSO. I'm using the standard OID Security Provider.As long as my user in ldap is located within a group that is part of the cn=groups everything works fine. However, if the user is defined in a nested group authentication fails.
Scenario 1 (working):
cn=mse-se-staff,cn=groups,dc=global,dc=mycompany,dc=net
Scenario 2 (not working):
cn=mse-se-staff,cn=exchange,cn=groups,dc=global,dc=mycompany,dc=net
I know that when using a third party ldap provider one can change the searchscope to search nested groups. Is there a way to set this in the standard OID security provider as well?
I have tried pre-pending the security-role-mapping with the additional group like so:
     <security-role-mapping name="USERS">
          <group name="exchange/mse-se-staff" />
     </security-role-mapping>
This did not work however. Can I use nested groups with OID? Again this works fine if the user is defined in a group that is part of cn=groups.
Here are all the important configuration pieces:
web.xml:
<security-constraint>
          <web-resource-collection>
               <web-resource-name>access to the application</web-resource-name>
               <url-pattern>/svc</url-pattern>                               
          </web-resource-collection>
          <!-- authorization to admin urls -->
          <auth-constraint>
               <role-name>USERS</role-name>
          </auth-constraint>
</security-constraint>
orion-application.xml:
     <security-role-mapping name="USERS">
          <group name="mse-se-staff" />
     </security-role-mapping>
     <jazn provider="LDAP" location="*my ldap here*">
     <jazn-web-app auth-method="SSO" jaas-mode="doAsPrivileged" />
</jazn>
Thanks,
Marc

Answer 1

Could you try settings java.naming.referral jndi env referral and re try.