Security Realms have an attribute "map-groups-to-roles", which is not documented. IMO it's important setting for the RBAC and we should cover it. (Maybe after fixing the bug 1149104) The domain model description says about this attribute: "After a users group membership has been loaded should a 1:1 relationship be assumed regarding group to role mapping." You can get more details if you run: ./jboss-cli.sh -c "/core-service=management/security-realm=ManagementRealm:read-resource-description"