return roles;
    }

    protected void processSubRoles(final LdapUser ldapUser, final String bindDn, final Set<String> subRoleSet, final String groupFilter,
            final Set<String> roleSet) {
        // (member:1.2.840.113556.1.4.1941:=%s)
        if (subRoleSet.isEmpty()) {
            return;
        }
        String filter = subRoleSet.stream().map(s -> String.format(groupFilter, s)).collect(Collectors.joining());

    static final int OPEN_FN_TRUNC = 0x02;

    int tflags, desiredAccess, searchAttributes, fileAttributes, creationTime, openFunction, allocationSize;


    // flags is NOT the same as flags member

    /**
     * 
     * @param config
     * @param fileName
     * @param access
     * @param shareAccess
     * @param flags
     * @param fileAttributes
     * @param andx
     */

         * with everything else. If the below clause evaluates true
         * the andx command will not be written and therefore the
         * response will not read a batched command and therefore
         * the 'received' member of the response object will not
         * be set to true indicating the send and sendTransaction
         * methods that the next part should be sent. This is a
         * very indirect and simple batching control mechanism.

     *            name associated with SIDs will be required, the SID_FLAG_RESOLVE_SIDS
     *            flag should be used which causes all group member SIDs to be resolved
     *            together in a single more efficient operation.
     * @return a map of group SID to member SIDs
     * @throws CIFSException
     */

     *
     * @param authorityServerName
     *            The hostname of the server that should be queried. For maximum efficiency this should be the hostname
     *            of a domain controller however a member server will work as well and a domain controller may not
     *            return names for SIDs corresponding to local accounts for which the domain controller is not an
     *            authority.
     * @param tc

    int flags,
        desiredAccess,
        searchAttributes,
        fileAttributes,
        creationTime,
        openFunction,
        allocationSize;

    // flags is NOT the same as flags member

    SmbComOpenAndX( String fileName, int access, int flags, ServerMessageBlock andx ) {
        super( andx );
        this.path = fileName;
        command = SMB_COM_OPEN_ANDX;

        desiredAccess = access & 0x3;

                for (final Map<String, Object> memberOf : memberOfList) {
                    if (logger.isDebugEnabled()) {
                        logger.debug("member: {}", memberOf);
                    }
                    String memberType = (String) memberOf.get("@odata.type");
                    if (memberType == null) {

         * with everything else. If the below clause evaluates true
         * the andx command will not be written and therefore the
         * response will not read a batched command and therefore
         * the 'received' member of the response object will not
         * be set to true indicating the send and sendTransaction
         * methods that the next part should be sent. This is a
         * very indirect and simple batching control mechanism.

        asyncManager.async(() -> {
            insertLogin(user);
        });
    }

    protected void insertLogin(final Object member) {
        // nothing
    }

    @Override
    protected void checkPermission(final LoginHandlingResource resource) throws LoginRequiredException {

 * JMORRIS         <03>  UNIQUE      Registered
 * 
 * MAC Address = 00-B0-34-21-FA-3B
 * </pre>
 * 
 * </blockquote>
 * <p>
 * The hostname of this machine is <code>JMORRIS2</code>. It is
 * a member of the group(a.k.a workgroup and domain) <code>BILLING-NY</code>. To
 * obtain an {@link java.net.InetAddress} for a host one might do:
 *
 * <pre>
 * 
 * InetAddress addr = NbtAddress.getByName("jmorris2").getInetAddress();