protected Collection<String> getRoleNamesForGroups(Collection<String> groupNames) {
        Set<String> roleNames = new HashSet<String>(groupNames.size());

        if (groupRolesMap != null) {
            for (String groupName : groupNames) {
                String strRoleNames = groupRolesMap.get(groupName);
                if (strRoleNames != null) {
                    for (String roleName : strRoleNames.split(ROLE_NAMES_DELIMETER)) {

                        if (LOGGER.isDebugEnabled()) {
                            LOGGER.debug("User is member of group [" + groupName + "] so adding role [" + roleName + "]");
                        }

                        roleNames.add(roleName);

                    }
                }
            }
        }
        return roleNames;
    }
This method is called by the default implementation to translate Active Directory group names
to role names.  This implementation uses the {@link #groupRolesMap} to map group names to role names.

@param groupNames the group names that apply to the current user.
@return a collection of roles that are implied by the given role names.
core/src/main/java/org/apache/shiro/realm/activedirectory/ActiveDirectoryRealm.java