The additional Active Directory user account attributes are not loaded into the Client-Principal as properties when using AD authentication with PASOE and when OEClientPrincipalFilter.loadAccntAttrList=* is set in webapp's oeablSecurity.properties file.

The Client-Principal properties are being listed by using the LIST-PROPERTY-NAMES method of the Client-Principal object.

The exact cause is not known at this time.

Until the fix is available, use the workaround below.

Follow these steps:

• Edit %DLC%\servers\pasoe\common\spring\authManagers.xml .
• Search for for the section that starts with the following: <b:bean id="adAuthenticationProvider"
• Add the lines in bold / red to this section:

<b:bean id="adAuthenticationProvider"
  class="org.springframework.security.ldap.authentication.ad.ActiveDirectoryLdapAuthenticationProvider">
    <b:constructor-arg index="0" value="${ad.user.domain}" />
    <b:constructor-arg index="1" value="${ad.ldap.url}" />
    <b:constructor-arg index="2" value="${ad.ldap.rootdn}" />
    <b:property name="ConvertSubErrorCodesToExceptions" value="true" />
    <b:property name="AuthoritiesMapper" ref="adAuthoritiesMapper" />
    
    <!-- LDAP user account information loader bean -->
    <b:property name="userDetailsContextMapper" ref="ldapUserDetailsContextMapper" />
</b:bean>

• Restart the PASOE instance for the changes to take effect.