I can't think of a better default however. The DN-RoleMapper is specific to DistinguishedNames...