This graphic shows how logical roles that are defined in an application deployment descriptor are mapped to groups defined in the principals.xml user repository. This graphic also shows the following: (1) The logical roles can either be defined in the application.xml, ejb_jar.xml, or web.xml file. (2) The config/principals.xml or principals.xml (application-specific) is the user repository. (3) The mapping of logical roles to groups can either be defined in the orion_application.xml, orion_ejb_jar.xml, or orion_web.xml file.