New Post: Query within site collection

Hmm, yes, I think that scenario will work.
I'm just not sure if FillSearch will be called on every scenario where you want to restrict the permissions returned, maybe you'll have to override FillResolve([...]string[...]) as well.
But in any case, you should not override FillResolve([...]SPClaim[...])

Quick question for you: would that help if LDAPCP had an overridable method that would always be called after permissions are created, but before they are added to the list (so that you have a chance to remove the ones already created, and add new ones)?

Thanks,
Yvan