ActiveDirectoryLdapAuthenticationProvider not working with custom searchFilter since domain is added to username

Summary

Since SEC-1915 the ActiveDirectoryLdapAuthenticationProvider provides means to insert a custom searchFilter to select which user is taken from Active Directory.

The example given is searching by 'sAMAccountName' instead of 'userPrincipalName' but even this example is not working in real Active Directories.

Actual Behavior

There are two steps involved:
1.) Binding to the Active Directory Server: Here the domain Part is added to the given Username to bind. This works like a charm
2.) Finding the User in the Directory to Fill in all userDetails. This does not work at the moment, since the domain Part is also added to the username before feeding it to the given searchFilter (e.g. (sAMAccountName={0}). The User is not found since sAMAccountnames do not contain domain information. The authentication fails.

There is a test within the project, but it uses a mock that is not modeled to copy real AD behaviour: it always finds the sAMAccountName whether provided with or without the domain part ...

Expected Behavior

The ActiveDirectoryLdapAuthenticationProvider should use the domain Part ONLY for binding to the directory, for queryiing the username should be used AS-IS.

Expected behaviour is that (sAMAccountName={0}) searchFilter works against real Active Directory

Configuration

AD Server Windows 2013

Version

Verified in 3.2.9.RELEASE, Code looks the same in Current 4.x versions

Sample

AbstractLdapAuthenticationProvider ad = AbstractLdapAuthenticationProvider('domain.com','ldaps://active-directory');
ad.setSearchFilter("(sAMAccountName={0})");

Read ActiveDirectoryLdapAuthenticationProvider and the existing test that uses a mock Active Directory; trace how the domain is applied during binding and searchFilter expansion. The work is done when binding still uses the domain, while a custom sAMAccountName filter receives the username without domain information and the test reflects that behavior.