Major Description
The role mapping is via a properties file, which cold be achieved via the properties login module, however the roles also map nicely from the review users groups.
Making the role file optional and using the group info as roles by default is more intuitive.
Adding an optional ignoreTokenReviewRoles to disable the role association from the group information gives full flexibility.