[id='authz_role_mappers-{context}']
= Role Mappers
{brandname} includes a `PrincipalRoleMapper` API that maps security Principals
in a Subject to authorization roles. There are two role mappers available by
default:

IdentityRoleMapper:: Uses the Principal name as the role name.
+
* Java class: `org.infinispan.security.mappers.IdentityRoleMapper`
* Declarative configuration: `<identity-role-mapper />`

CommonNameRoleMapper:: Uses the Common Name (CN) as the role name if the
Principal name is a Distinguished Name (DN). For example the
`cn=managers,ou=people,dc=example,dc=com` DN maps to the `managers` role.
+
* Java class: `org.infinispan.security.mappers.CommonRoleMapper`
* Declarative configuration: `<common-name-role-mapper />`

You can also use custom role mappers that implement the
`org.infinispan.security.PrincipalRoleMapper` interface. To configure custom
role mappers declaratively, use: `<custom-role-mapper class="my.custom.RoleMapper" />`

.Reference

* link:{javadocroot}/org/infinispan/security/package-summary.html[{brandname} Security API]
* link:{javadocroot}/org/infinispan/security/PrincipalRoleMapper.html[org.infinispan.security.PrincipalRoleMapper]
