[ https://issues.jboss.org/browse/WFLY-2854?page=com.atlassian.jira.plugin.... ] arjan tijms updated WFLY-2854: ------------------------------ Description: When authentication has taken place in a web application such that {{HttpServletRequest#getUserPrincipal}} does not return null, testing for role '**' using {{HttpServletRequest#isUserInRole}} returns false. This is not correct. According to Servlet 13.3: {quote} {noformat} If the role-name of the security-role to be tested is “**”, and the application has NOT declared an application security-role with role-name “**”, isUserInRole must only return true if the user has been authenticated; {noformat} {quote} This is demonstrated by the following test: https://github.com/arjantijms/javaee7-samples/blob/master/jacc/contexts/s... was: When authentication has taken place in a web application such that {{HttpServletRequest#getUserprincipap}} does not return null, testing for role '**' using {{HttpServletRequest#isUserInRole}} returns false. This is not correct. According to Servlet 13.3: {quote} {noformat} If the role-name of the security-role to be tested is “**”, and the application has NOT declared an application security-role with role-name “**”, isUserInRole must only return true if the user has been authenticated; {noformat} {quote} This is demonstrated by the following test: https://github.com/arjantijms/javaee7-samples/blob/master/jacc/contexts/s... -- This message is automatically generated by JIRA. If you think it was sent incorrectly, please contact your JIRA administrators For more information on JIRA, see: http://www.atlassian.com/software/jira