Suppose I have a database like this:

This is set up to give role-wise menu permissions.

Please note that, User-table has no direct relationship with Permission-table.

Then how should I map this class against the database-tables?

class User
    {
        public int ID { get; set; }
        public string Name { get; set; }
        public string Username { get; set; }
        public string Password { get; set; }
        public bool? IsActive { get; set; }

        public IList<Role> RoleItems { get; set; }
        public IList<Permission> PermissionItems { get; set; }
        public IList<string> MenuItemKeys { get; set; }
    }

This means,

(1) Every user has some Roles.

(2) Every user has some Permissions (depending on to Roles).

(3) Every user has some permitted MenuItemKeys (according to Permissions).

How should my User.hbm.xml look like?