@Override
    protected List<SimpleGrantedAuthority> generateAuthorizationForLdapEntry(final Principal profile, final LdapEntry userEntry) {
        LOGGER.debug("Attempting to get roles for user [{}].", userEntry.getDn());
        val response = FunctionUtils.doUnchecked(() -> groupSearchOperation.execute(
            LdapUtils.newLdaptiveSearchFilter(groupSearchOperation.getTemplate().getFilter(),
                LdapUtils.LDAP_SEARCH_FILTER_DEFAULT_PARAM_NAME, CollectionUtils.wrap(userEntry.getDn()))));
        LOGGER.debug("LDAP role search response: [{}]", response);
        return response
            .getEntries()
            .stream()
            .map(entry -> entry.getAttribute(groupAttributeName))
            .filter(Objects::nonNull)
            .map(attribute -> attribute
                .getStringValues()
                .stream()
                .map(entry -> entry.toUpperCase(Locale.ENGLISH))
                .map(role -> StringUtils.prependIfMissing(role, groupPrefix))
                .collect(Collectors.toList()))
            .flatMap(List::stream)
            .map(SimpleGrantedAuthority::new)
            .collect(Collectors.toList());
    }
Provides a simple generator implementation that obtains user roles from an LDAP search.
Two searches are performed by this component for every user details lookup:
<ol>
<li>Search for an entry to resolve the username. In most cases the search should return exactly one result,
but the {@link #isAllowMultipleResults()} property may be toggled to change that behavior.</li>
<li>Search for groups of which the user is a member. This search commonly occurs on a separate directory
branch than that of the user search.</li>
</ol>

@author Jerome Leleu
@author Marvin S. Addison
@author Misagh Moayyed
@since 5.1.0
support/cas-server-support-ldap-core/src/main/java/org/apereo/cas/authorization/LdapUserGroupsToRolesAuthorizationGenerator.java