<access-control>
  <role-mapping use-realm-roles="true/false">
    <role name="role_name">
      <includes>
        <user realm="realm_name" name="user_name" />  <!-- Realm is optional, most useful for servers where different realms are used for different interfaces. -->
        <group realm="realm_name" name="group_name" />
      </includes>
      <excludes>
        <user realm="realm_name" name="user_name" />
        <group realm="realm_name" name="group_name" />
      </excludes>
    </role>
  </role-mapping>
</access-control>