Public Sub RemoveRole(ByRef role As Role)
        If Me.RoleAssignments(role) IsNot Nothing Then
            _roleAssignments.Remove(RoleAssignments(role))
        End If
    End Sub

Public Sub AssignRole(ByVal role As IRole, ByVal ParamArray constraints As IConstraint())
        If Not Me.Applications.Contains(role.Application) Then
            Throw New InvalidOperationException(String.Format("The user {0} does not have access to role's application ({1})", Me.LoginId, role.Application.ApplicationId))
        End If

        'if the user already has this role, append the constraints
        If HasRole(role, Context.Emtpy) Then
            For Each constraint As CompositeConstraint In constraints
                Me.RoleAssignments(role).AddConstraint(constraint)
            Next
        Else
            'user doesn't have role, add a new role assigment
            Me._roleAssignments.Add(RoleAssignment.Create(Me, role, constraints))
        End If


    End Sub

<class name="User" table="[User]">
    <id name="LoginId" column="LoginId" type="GSF.Uaas.DataAccess.CaseInsensitiveStringType, GSF.Uaas.DataAccess" length="50" access="nosetter.camelcase-underscore">
      <generator class="assigned" />     
    </id>

    <!-- main properties -->
    <property name="FirstName" column="firstName" type="String" length="50" />
    <property name="LastName" column="lastName" type="String" length="50" />
   
    <!-- associations -->
    <bag name="roleAssignments" lazy="true" inverse="true" access="NHibernate.Generics.GenericAccessor, NHibernate.Generics" cascade="all-delete-orphan">
      <key column="LoginId" />
      <one-to-many class="RoleAssignment"/>
    </bag>

    <set name="applications" lazy="true" access="NHibernate.Generics.GenericAccessor, NHibernate.Generics" table="AppUserXRef">
      <key column="LoginId" />
      <many-to-many class="Application" column="ApplicationId" />
    </set>
 
  </class>