...
Administrators should add roles to this realm that which have the correct appropriate security function (or permission). This function name is 'su.can_su' by default (but can be changed by an administrator by editing the tool registration file).
...