OBO token - roles encryption

** On behalf of a user of Slack **

Hello all,
I am trying to setup OBO token, but the documentation is a bit limited in explaining how to do this.
So I have configured the security config for on_behalf_of with the required stuff.
I can issue an OBO token via the endpoint and that seems a valid token.
Now I need to create an OBO token myself, but can’t find any documentation on how to encrypt the roles.
Next to that the documentation says something about disabling the role encryption
The Role Security Mode [source code]: The configuration determines the roles claim encryption.

Role Security Mode On (default value): Roles claim will be encrypted.
Encrypted mapped roles (er)
Role Security Mode Off: Roles claims is in plain-text. Both the mapped roles and backend roles are included in the claim [related discussion].
Decrypted mapped roles in plain text (dr)
Decrypted backend roles (br)Only no explanation on where this is configured.

Somenone who could sched a bit of light on this?

According to GitHub, the roles are encrypted when encryption key is provided. When is missing, roles are attached in a plain text.