How to restrict hawtio login by LDAP group ?

Issue

• We are not able to restrict Hawt.IO login by LDAP group.
• We have successfully setup LDAP authentication and authorization. We can login using the client (client -u <user> -p <pass> ...) and webservices and have it only allow those in a certain group specified by:

karaf.admin.role=<AD Group>

• The "etc/system.properties" has the following entry in it but it will just deny login when they are active.

hawtio.authenticationEnabled=true 
hawtio.realm=karaf 
hawtio.role=<AD group> 
hawtio.rolePrincipalClasses=org.apache.karaf.jaas.boot.principal.RolePrincipal,org.apache.karaf.jaas.modules.RolePrincipal,org.apache.karaf.jaas.boot.principal.GroupPrincipal

• We can log into Hawt.io successfully, but it won't honor that group/role limitation.
• The "ldap-module.xml" configuration is correct as the login is working fine for the shell and client scripts.