Looks like this statement is never reached, if the user has the "wrong" role:

https://github.com/aerogear/aerogear-security-picketlink/blob/master/src/main/java/org/jboss/aerogear/security/picketlink/authz/IdentityManagementImpl.java#L140

Perhaps catching the IdentityManagementException in there is an option, in order to be able to actually return the false if the "wrong" role is present
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira