The mapped-role-mapper attribute should support expressions, but does not due to the use of a string -> list of strings mapping. MapAttributeDefinition only supports expressions for the values of the map, so it does not check the keys or the strings nested within the list. The attribute should be changed to not use a MapAttributeDefinition.