<p>If the <strong>role source</strong> is <strong>User group service</strong>, the name of the service has to be specified.</p><p>If the <strong>role source</strong> is <strong>Role service</strong>, the name of the service has to be specified.</p><p>If the <strong>role source</strong> is <strong>Request header</strong>, the name of the HTTP header attribute has to be specified.The content of this attribute are the roles of the principal. The default role delimiter is the semicolon <strong>;</strong>.GeoServer accepts the sent roles without verification.</p>