A security infrastructure that authenticates the user identity against an external directory (such as an LDAP directory) and creates a user entitlement filter that limits access to only those records that the user is authorized to see. One or more login modules are configured to perform the actual authentication. See also file-based login module, LDAP login module, and user entitlement filter.