one entitlements mapping for all authentication backends