<application-policy name="jmx-console">
<authentication>
      <login-module code="org.jboss.security.auth.spi.LdapExtLoginModule" flag="required" >
         <module-option name="java.naming.provider.url">ldap://ab.cd.ef:389</module-option>
         <module-option name="bindDN">DOMAINadmin</module-option>
         <module-option name="bindCredential">passwd</module-option>
         <module-option name="baseCtxDN">cn=Users,dc=ab,dc=cd,dc=ef</module-option>
         <module-option name="baseFilter">(sAMAccountName={0})</module-option>
         <module-option name="rolesCtxDN">cn=Users,dc=ab,dc=cd,dc=ef</module-option>
         <module-option name="roleFilter">(sAMAccountName={0})</module-option>
         <module-option name="roleAttributeID">memberOf</module-option>
         <module-option name="roleAttributeIsDN">true</module-option>
         <module-option name="roleNameAttributeID">cn</module-option>
         <module-option name="roleRecursion">-1</module-option>
         <module-option name="searchScope">ONELEVEL_SCOPE</module-option>
      </login-module>
   </authentication>