Provide an option to parse the role name out of the memberOf attributes, rather than re-query LDAP for each role.

The option would look something like:

<module-option name="roleAttributeIsDN">true</module-option>
<module-option name="roleNameAttributeID">myprofile</module-option>
<module-option name="parseRoleNameFromDN">true</module-option>

Alternatively, this could automatically be done if the memberOf attribute contained the roleNameAttributeID.