Sun/Oracle roles are a proprietary, non-standard grouping mechanism that provide little value over standard grouping mechanisms. The PingDirectory Server does not support DSEE roles and does not support the use of the roleDN ACI bind rule. However, the same behavior can be achieved by converting the DSEE roles to standard groups and using the groupDN ACI bind rule.