Used versions: * Spring Framework 1.2.8 * Acegi Security 1.0.3 The groups have the form APPNAME_ROLE/Groups where APPNAME is the name off the application (obviously) and ROLE is something like ADMIN, EDITOR or READER. This makes rolePrefix unneccessary. Web user names are NOT hierarchical (Flat names unlike Notes names.) but it'd be easy to add something like /USERS in userDnPatterns. o=groups true cn={0}