I am attempting to hook an LdapLoginModule to an ActiveDirectory user store, and in looking through the code, I cannot determine how, or when the login module "maps" the roles it collects into the Realm controlling the application.

Can somebody clarify this for me ?

Thank you