http://www.dmartin.es/2014/07/rbac-role-based-access-control-in-eap-6-2-part-i/