Roles should use an adequate data type to get persisted as entities
At the moment the roles of an account get saved as a php-serialized array inside "flow3_security_account", e.g.:
This is due to (in Packages/Framework/FLOW3/Classes/Security/Policy/Role.php)
/** * @var array */ protected $roles = array();
this should be something like this (untested, just to transport the idea, I have no idea of Doctrine)
/** * @var \Doctrine\Common\Collections\ArrayCollection<\F3\FLOW3\Security\Policy\Role> * @ManyToMany */ protected $roles = array();
so that they will get persisted as the already prepared entities \F3\FLOW3\Security\Policy\Role.