Currently the CommonNameRoleMapper only works if it is passed a DN-style name and returns null otherwise.
In the case of mixed name sources, however, if the name doesn't match CN=x, it should behave as the identity role mapper, returning the name as-is