When we use IDPFilter, the Principal sent to the RoleGenerator is of type SimplePrincipal. We need a role generator that can use the JACC policycontext API to get access to the original HttpServletRequest which will be Catalina Request whose getPrincipal() call will yield the GenericPrincipal (holder of Role information)