Index: kernel-impl/src/main/java/org/sakaiproject/authz/impl/DbAuthzGroupService.java
===================================================================
--- kernel-impl/src/main/java/org/sakaiproject/authz/impl/DbAuthzGroupService.java	(revision 76868)
+++ kernel-impl/src/main/java/org/sakaiproject/authz/impl/DbAuthzGroupService.java	(working copy)
@@ -2381,6 +2381,61 @@
 		/**
 		 * {@inheritDoc}
 		 */
+		public Map<String, String> getUserRoles(String userId, Collection<String> azGroupIds)
+		{
+			final HashMap<String, String> rv = new HashMap<String, String>();
+			if (userId == null || "".equals(userId))
+				return rv;
+
+			String inClause;
+			int azgCount = azGroupIds == null ? 0 : azGroupIds.size();
+			if (azgCount == 0) {
+				inClause = " 1=1 ";
+			}
+			else {
+				inClause = orInClause(azgCount, "REALM_ID");
+			}
+
+			String sql = dbAuthzGroupSql.getSelectRealmRolesSql(inClause);
+			Object[] fields = new Object[1 + azgCount];
+			fields[0] = userId;
+			if (azgCount > 0) {
+				int pos = 1;
+				for (String s : azGroupIds) {
+					fields[pos++] = s;
+				}
+			}
+
+			m_sql.dbRead(sql, fields, new SqlReader()
+			{
+				public Object readSqlResultRecord(ResultSet result)
+				{
+					try
+					{
+						String realmId = result.getString(1);
+						String roleName = result.getString(2);
+
+						// ignore if we get an unexpected null -- it's useless to us
+						if ((realmId != null) && (roleName != null))
+						{
+							rv.put(realmId, roleName);
+						}
+					}
+					catch (Throwable t)
+					{
+						M_log.warn("Serious database error occurred reading result set", t);
+					}
+
+					return null;
+				}
+			});
+
+			return rv;
+		}
+
+		/**
+		 * {@inheritDoc}
+		 */
 		public Map getUsersRole(Collection userIds, String azGroupId)
 		{
 			if ((userIds == null) || (userIds.isEmpty()) || (azGroupId == null))
Index: kernel-impl/src/main/java/org/sakaiproject/authz/impl/DbAuthzGroupSqlDefault.java
===================================================================
--- kernel-impl/src/main/java/org/sakaiproject/authz/impl/DbAuthzGroupSqlDefault.java	(revision 76868)
+++ kernel-impl/src/main/java/org/sakaiproject/authz/impl/DbAuthzGroupSqlDefault.java	(working copy)
@@ -473,6 +473,13 @@
 				+ "inner join SAKAI_REALM_ROLE SRR on SRRG.ROLE_KEY = SRR.ROLE_KEY "
 				+ "where SR.REALM_ID = ? and SRRG.USER_ID = ? and SRRG.ACTIVE = '1'";
 	}
+	
+	public String getSelectRealmRolesSql(String inClause)
+	{
+		return "select SR.REALM_ID, SRR.ROLE_NAME from SAKAI_REALM_RL_GR SRRG " + "inner join SAKAI_REALM SR on SRRG.REALM_KEY = SR.REALM_KEY "
+				+ "inner join SAKAI_REALM_ROLE SRR on SRRG.ROLE_KEY = SRR.ROLE_KEY "
+				+ "where SRRG.USER_ID = ? and SRRG.ACTIVE = '1' and " + inClause + " ";
+	}
 
 	public String getSelectRealmRoleSql()
 	{
Index: kernel-impl/src/main/java/org/sakaiproject/authz/impl/BaseAuthzGroupService.java
===================================================================
--- kernel-impl/src/main/java/org/sakaiproject/authz/impl/BaseAuthzGroupService.java	(revision 76868)
+++ kernel-impl/src/main/java/org/sakaiproject/authz/impl/BaseAuthzGroupService.java	(working copy)
@@ -892,6 +892,14 @@
 	/**
 	 * {@inheritDoc}
 	 */
+	public Map<String, String> getUserRoles(String userId, Collection<String> azGroupIds)
+	{
+		return m_storage.getUserRoles(userId, azGroupIds);
+	}
+	
+	/**
+	 * {@inheritDoc}
+	 */
 	public Map getUsersRole(Collection userIds, String azGroupId)
 	{
 		return m_storage.getUsersRole(userIds, azGroupId);
@@ -1365,6 +1373,18 @@
 		String getUserRole(String userId, String azGroupId);
 
 		/**
+		 * Get all role names for a given user in a set of AuthzGroups.
+		 *
+		 * @param userId
+		 *        The user ID of the person to search for.
+		 * @param azGroupIds
+		 *        A collection of AuthzGroup IDs to narrow the search (may be empty or null to search all).
+		 * @return A Map<String, String> (AuthzGroup ID -> role name) for every AuthzGroup where the user is a member, filtered to the set of AuthzGroups in azGroupIds (if non-null and non-empty).
+		 *
+		 */
+		Map<String, String> getUserRoles(String userId, Collection<String> azGroupIds);
+		
+		/**
 		 * Get the role name for each user in the userIds Collection in this AuthzGroup.
 		 * 
 		 * @param userId
Index: kernel-impl/src/main/java/org/sakaiproject/authz/impl/DbAuthzGroupSql.java
===================================================================
--- kernel-impl/src/main/java/org/sakaiproject/authz/impl/DbAuthzGroupSql.java	(revision 76868)
+++ kernel-impl/src/main/java/org/sakaiproject/authz/impl/DbAuthzGroupSql.java	(working copy)
@@ -141,6 +141,8 @@
 
 	String getSelectRealmRoleSql();
 
+	String getSelectRealmRolesSql(String inClause);
+	
 	String getSelectRealmSize();
 
 	String getSelectRealmUpdate();
Index: api/src/main/java/org/sakaiproject/authz/api/AuthzGroupService.java
===================================================================
--- api/src/main/java/org/sakaiproject/authz/api/AuthzGroupService.java	(revision 76868)
+++ api/src/main/java/org/sakaiproject/authz/api/AuthzGroupService.java	(working copy)
@@ -374,6 +374,18 @@
 	 * @return the role name for this user in this AuthzGroup, if the user has active membership, or null if not.
 	 */
 	String getUserRole(String userId, String azGroupId);
+	
+	/**
+	 * Get all role names for a given user in a set of AuthzGroups.
+	 *
+	 * @param userId
+	 *        The user ID of the person to search for.
+	 * @param azGroupIds
+	 *        A collection of AuthzGroup IDs to narrow the search (may be empty or null to search all).
+	 * @return A Map<String, String> (AuthzGroup ID -> role name) for every AuthzGroup where the user is a member, filtered to the set of AuthzGroups in azGroupIds (if non-null and non-empty).
+	 *
+	 */
+	Map<String, String> getUserRoles(String userId, Collection<String> azGroupIds);
 
 	/**
 	 * Get the role name for each user in the userIds Collection in this AuthzGroup, for each of these users who have membership (membership gives the user a single role).
Index: api/src/main/java/org/sakaiproject/authz/cover/AuthzGroupService.java
===================================================================
--- api/src/main/java/org/sakaiproject/authz/cover/AuthzGroupService.java	(revision 76868)
+++ api/src/main/java/org/sakaiproject/authz/cover/AuthzGroupService.java	(working copy)
@@ -330,6 +330,14 @@
 		return service.getUserRole(param0, param1);
 	}
 
+	public static java.util.Map<java.lang.String, java.lang.String> getUserRoles(java.lang.String param0, java.util.Collection<java.lang.String> param1)
+	{
+		org.sakaiproject.authz.api.AuthzGroupService service = getInstance();
+		if (service == null) return null;
+
+		return service.getUserRoles(param0, param1);
+	}
+
 	public static java.util.Map getUsersRole(java.util.Collection param0, java.lang.String param1)
 	{
 		org.sakaiproject.authz.api.AuthzGroupService service = getInstance();