*/
    protected void processSubRoles(final LdapUser ldapUser, final String bindDn, final Set<String> subRoleSet, final String groupFilter,
            final Set<String> roleSet) {
        // (member:1.2.840.113556.1.4.1941:=%s)
        if (subRoleSet.isEmpty()) {
            return;
        }
        String filter = subRoleSet.stream().map(s -> String.format(groupFilter, s)).collect(Collectors.joining());

    7+. These platforms lack support for TLS 1.2 and should not be used. But because upgrading is
    difficult we will backport critical fixes to the 3.12.x branch through December 31, 2021. (This
    commitment was originally through December 31, 2020; we have since extended it.)

 *  **TLSv1 and TLSv1.1 are no longer enabled by default.** Major web browsers are working towards

   * references, instead of calling {@code equals}, to determine whether a provided object matches
   * an element in the set. For example, {@code contains} returns {@code false} when passed an
   * object that equals a set member, but isn't the same instance. This behavior is similar to the
   * way {@code IdentityHashMap} handles key lookups.
   *
   * @since 8.0
   */
  public static <E extends @Nullable Object> Set<E> newIdentityHashSet() {