BoolQueryBuilder boolQuery = QueryBuilders.boolQuery();
        Set<String> roles = Set.of("role1", "role2");

        queryHelper.buildRoleQuery(roles, boolQuery);

        String queryString = boolQuery.toString();
        assertTrue(queryString.contains("role1"));
        assertTrue(queryString.contains("role2"));
        assertTrue(queryString.contains("filter"));
    }

    @Test

    private User createTestUser(String username, String password) {
        User user = new User();
        user.setName(username);
        user.setPassword(password);
        user.setRoles(new String[] { "role1", "role2" });
        user.setGroups(new String[] { "group1", "group2" });
        return user;
    }

    // Test LdapManager implementation
    private static class TestLdapManager extends LdapManager {

        testUser.setRoleNames(new String[] { "admin", "user", "manager" });
        roles = fessUserBean.getRoles();
        assertEquals(3, roles.length);
        assertEquals("admin", roles[0]);
        assertEquals("user", roles[1]);
        assertEquals("manager", roles[2]);
    }

    @Test
    public void test_getGroups() {
        // Test with empty groups
        testUser.setGroupNames(new String[] {});

Shinsuke Sugaya <******@****.***> 1638450896 +0900

package org.codelibs.fess.opensearch.user.exentity;

import java.util.HashMap;
import java.util.Map;

import org.codelibs.fess.opensearch.user.bsentity.BsRole;

/**
 * @author FreeGen
 */
public class Role extends BsRole {

    private static final long serialVersionUID = 1L;

    private Map<String, String> attributes;

    public Long getVersionNo() {
        return asDocMeta().version();
    }

            this.groups = groups;
        }

        /**
         * Sets the user's role assignments.
         * @param roles Array of role names.
         */
        public synchronized void setRoles(final String[] roles) {
            this.roles = roles;
        }

        /**
         * Resets permissions to force recalculation on next getPermissions() call.

	}

	rolePolicy := env.Get(EnvIdentityPluginRolePolicy, kv.Get(RolePolicy))
	if rolePolicy == "" {
		return args, config.Errorf("A role policy must be specified for Identity Management Plugin")
	}

	resourceID := "idmp-"
	roleID := env.Get(EnvIdentityPluginRoleID, kv.Get(RoleID))
	if roleID == "" {
		// We use a hash of the plugin URL so that the ARN remains
		// constant across restarts.
		h := sha1.New()

                logger.warn("Failed to access groups/roles: {}", contentMap);
            }
        } catch (final IOException e) {
            logger.warn("Failed to access groups/roles in Entra ID.", e);
        }
    }

    /**
     * Adds a group or role name to the specified list.
     * @param list The list to add the group or role name to.
     * @param value The group or role name value.

#### Adding 'admin' Role

- Go to Roles
  - Add new Role `admin` with Description `${role_admin}`.
  - Add this Role into compositive role named `default-roles-{realm}` - `{realm}` should be replaced with whatever realm you created from `prerequisites` section. This role is automatically trusted in the 'Service Accounts' tab.

- Check that `account` client_id has the role 'admin' assigned in the "Service Account Roles" tab.

Shinsuke Sugaya <******@****.***> 1638450896 +0900