env var

Author: andrejtonev

pages/database-management/authentication-and-authorization/auth-system-integrations.mdx

@@ -206,12 +206,21 @@ identity service roles correspond to Memgraph’s.
 
 The role mapping is defined as a string where individual mappings are separated
 by a semicolon `;`. Each mapping is structured as follows:
-`{identity service role}:{Memgraph role}`.
+`{identity service role}:{Memgraph role}, {another Memgraph role}, ...`.
+
+One identity service role can be mapped to one or more Memgraph roles. 
+When a user logs in and is assigned an identity service role that is mapped to an array of Memgraph roles, the user is assigned all of the mapped Memgraph roles. 
+For more information regarding how multi-role users are handled by Mmegraph, please visit [Multiple roles per user and multi-tenant roles](/database-management/authentication-and-authorization/multiple-roles).
 
 For example, the `entra.admin:memadmin; entra.user:memuser` mapping defines
 that the identity service roles `entra.admin` and `entra.user` respectively map
 to Memgraph’s `memadmin` and `memuser` roles.
 
+`entra.admin:memadmin; entra.user:memuser, memdev` maps `entra.user` to `memuser` and `memdev`.
+
+Different services use different parameters for defining roles. 
+Use `MEMGRAPH_SSO_{provider}_{protocol}_ROLE_FILED` to specify the token parameter that specifies the assigned roles.
+
 <Callout type="info">
 
 For correct operation, the Memgraph roles defined in the mapping need to be