code: def get_permissions_query(session, identifier_s):
      
      thedomain = case([(Domain.name == None, '*')], else_=Domain.name)
      theaction = case([(Action.name == None, '*')], else_=Action.name)
      theresource = case([(Resource.name == None, '*')], else_=Resource.name)
  
      action_agg = func.group_concat(theaction.distinct())
      resource_agg = func.group_concat(theresource.distinct())
  
      return (session.query(thedomain + ':' + action_agg + ':' + resource_agg).
              select_from(User).
              join(role_membership, User.pk_id == role_membership.c.user_id).
              join(role_permission, role_membership.c.role_id == role_permission.c.role_id).
              join(Permission, role_permission.c.permission_id == Permission.pk_id).
              outerjoin(Domain, Permission.domain_id == Domain.pk_id).
              outerjoin(Action, Permission.action_id == Action.pk_id).
              outerjoin(Resource, Permission.resource_id == Resource.pk_id).
              filter(User.identifier.in_(identifier_s)).
              group_by(Permission.domain_id, Permission.resource_id))
docs: :type identifier_s: list