}

        // LDAP: cn=%s
        // AD: (&(objectClass=user)(sAMAccountName=%s))
        final String filter = String.format(accountFilter, escapeLDAPSearchFilter(ldapUser.getName()));
        if (logger.isDebugEnabled()) {
            logger.debug("Account filter: {}", filter);
        }
        final Set<String> subRoleSet = new HashSet<>();