The process of associating the groups or principals (or both), recognised by the container with security roles specified in the deployment descriptor. Security roles must be mapped by the deployer before a component is installed in the server.