Used versions: * Spring Framework 1.2.8 * Acegi Security 1.0.3 The DN of a group is like cn=APPNAME_ROLE,cn=GROUPS,dc=company,dc=com. rolePrefix is unneccessary in this context. You can refine the groupSearchFilter e.g. (&(objectclass=groupOfUniqueNames)(uniqueMember={0})) cn={0},cn=Users cn=groups true (uniquemember={0}) cn