diff --git a/library/Icinga/Authentication/RolesConfig.php b/library/Icinga/Authentication/RolesConfig.php
new file mode 100644
index 000000000..51f07cc3b
--- /dev/null
+++ b/library/Icinga/Authentication/RolesConfig.php
@@ -0,0 +1,40 @@
+<?php
+/* Icinga Web 2 | (c) 2019 Icinga GmbH | GPLv2+ */
+
+namespace Icinga\Authentication;
+
+use Icinga\Application\Icinga;
+use Icinga\Repository\IniRepository;
+
+class RolesConfig extends IniRepository
+{
+    protected $configs = [
+        'roles' => [
+            'name'      => 'roles',
+            'keyColumn' => 'name'
+        ]
+    ];
+
+    protected function initializeQueryColumns()
+    {
+        $columns = [
+            'roles' => [
+                'name',
+                'users',
+                'groups',
+                'permissions',
+                'application/share/users',
+                'application/share/groups'
+            ]
+        ];
+
+        $moduleManager = Icinga::app()->getModuleManager();
+        foreach ($moduleManager->listInstalledModules() as $moduleName) {
+            foreach ($moduleManager->getModule($moduleName, false)->getProvidedRestrictions() as $restriction) {
+                $columns['roles'][] = $restriction->name;
+            }
+        }
+
+        return $columns;
+    }
+}