The ibm-portal-security element is the root element of a PAA Security Definitions descriptor. This element lists all application roles used by this application. Application roles are defined for a particular Portal Application. They need to be mapped to real users/groups of a Portal installation during the deployment of a Portal Application. In addition to the application-roles, it is possible to define role blocks defines role definitions specific to this Portal Application role block to be applied to objects in the topology descriptions Defines a new application role instance that can agregate other application roles, portal roles or J2EE roles. Application roles are defined for a particular Portal Application. They need to be mapped to real users/groups of a Portal installation during the deployment of a Portal Application. Defines a particular role, which is a tupel of the role type (aka action set) and an object in the topology to which the role type is applied roles types are specified in a string. Supported values are defined by Portal the object-ref specifies an object in the topology to which the role-type will be applied (using the unique ID of that object) references a particular J2ee role name of the referenced J2EE role Specifies a role block on a resource The object-ref specifies an object in the topology to which the role-block will be applied (using the unique ID of that object) The type of the role block. The role type (aka action set) that is blocked. This attribute is required if the block type is inheritance or propagation and it is not allowed if the type is none. The different modes that can be used for blocking action sets at a resource The resource does not inherit role mappings from its parent, i.e. the action set is blocked above the resource The resource does not propagate role mappings to its children, i.e. the action set is blocked below the resource Remove all role blocks on the specified resource. This overrides any other role blocks specified for the resource.