class DBService implements RolesProvider {

    void removePrincipalFromDomainRoles(ObjectStoreConnection con, String domainName, String principalName,
            String adminUser, String auditRef) {

        // extract all the roles that this principal is member of
        // we have to this here so that there are records of
        // entries in the role member audit logs and the domain
        // entries are properly invalidated

        List<PrincipalRole> roles = con.listPrincipalRoles(domainName, principalName);

        // we want to check if we had any roles otherwise
        // we don't want to update the domain mod timestamp

        if (roles.isEmpty()) {
            return;
        }

        for (PrincipalRole role : roles) {

            final String roleName = role.getRoleName();

            // process our delete role member operation

            if (LOG.isDebugEnabled()) {
                LOG.debug("removePrincipalFromDomainRoles: removing member {} from {}:role.{}",
                        principalName, domainName, roleName);
            }

            // we are going to ignore all errors here rather than
            // rejecting the full operation

            try {
                con.deleteRoleMember(domainName, roleName, principalName, adminUser, auditRef);
            } catch (ResourceException ex) {
                LOG.error("removePrincipalFromDomainRoles: unable to remove {} from {}:role.{} - error {}",
                        principalName, domainName, roleName, ex.getMessage());
            }

            // update our role and domain time-stamps, and invalidate local cache entry

            con.updateRoleModTimestamp(domainName, roleName);
        }

        con.updateDomainModTimestamp(domainName);
    }

    public  DBService(ObjectStore store, AuditLogger auditLogger, ZMSConfig zmsConfig, AuditReferenceValidator auditReferenceValidator);

}