Issue authenticating user on JBoss 7 against LDAP - authentication

Question

I am trying setup authentication on an application on JBoss 7 against a LDAP Server. Below is the link I have followed for the configuration
LDAP authentication with JBoss 7
The LDAP login module performs three queries against the LDAP server to log in a user, as follows:
As per JBoss in Action, there are 3 steps how JBoss LDAP Login Module works:
- The first query looks up the user object using only the login id. This search is similar to the first ldapsearch query that we showed you earlier.
- A second query is a login attempt using the user’s login id and the password.
- The last query obtains the group objects.
The password is used, but you don’t have to reference it in the login module. Now let’s take a look at another login module that helps simplify development and testing.
Looking in the LDAP Server logs it looks like my setup is only doing the first step but not the 2nd. So the login fails with a password error :
10:47:11,448 DEBUG [org.jboss.security] (http-/127.0.0.1:9080-1) PBOX000283: Bad password for username testuser1
10:47:11,450 TRACE [org.jboss.security] (http-/127.0.0.1:9080-1) PBOX000244: Begin abort method
10:47:11,450 DEBUG [org.jboss.security] (http-/127.0.0.1:9080-1) PBOX000206: Login failure: javax.security.auth.login.FailedLoginException: PBOX000070: Password invalid/Password required
at org.jboss.security.auth.spi.UsernamePasswordLoginModule.login(UsernamePasswordLoginModule.java:286) [picketbox-4.1.1.Final-redhat-1.jar:4.1.1.Final-redhat-1]
Here is the configuration from my standalone.xml:
<security-domain name="LDAPAuth" cache-type="default">
<authentication>
<login-module code="org.jboss.security.auth.spi.LdapExtLoginModule" flag="required">
<module-option name="java.naming.factory.initial" value="com.sun.jndi.ldap.LdapCtxFactory"/>
<module-option name="java.naming.provider.url" value="ldap://localhost:389"/>
<module-option name="java.naming.security.authentication" value="simple"/>
<module-option name="bindDN" value="cn=admin"/>
<module-option name="bindCredential" value="********"/>
<module-option name="baseCtxDN" value="ou=Internal,cn=Users,dc=company,dc=local"/>
<module-option name="baseFilter" value="(cn={0})"/>
<module-option name="roleFilter" value="(uniqumember={1})"/>
<module-option name="allowEmptyPasswords" value="false"/>
<module-option name="Context.REFERRAL" value="follow"/>
<module-option name="throwValidateError" value="true"/>
<module-option name="roleRecursion" value="0"/>
<module-option name="searchScope" value="SUBTREE_SCOPE"/>
<module-option name="password-stacking" value="useFirstPass"/>
<module-option name="Context.REFERRAL" value="follow"/>
<module-option name="throwValidateError" value="true"/>
</login-module>
</authentication>
</security-domain>