docs: private List<String> createRoles(com.ibm.ws.javaee.dd.web.common.SecurityConstraint archiveConstraint) {
          List<String> roles = new ArrayList<String>();
          AuthConstraint authConstraint = archiveConstraint.getAuthConstraint();
          if (authConstraint != null) {
              Map<String, ConfigItem<List<String>>> authConstraintMap = configurator.getConfigItemMap(AUTH_CONSTRAINT_KEY);
              String webResourceName = archiveConstraint.getWebResourceCollections().get(0).getWebResourceName();
              ConfigItem<List<String>> existingAuthConstraint = authConstraintMap.get(webResourceName);
              roles = authConstraint.getRoleNames();
              if (roles.contains(ALL_ROLES_MARKER)) {
                  roles = allRoles;
              }
              if (existingAuthConstraint == null) {
                  authConstraintMap.put(webResourceName, this.configurator.createConfigItem(roles));
              } else {
                  this.configurator.validateDuplicateConfiguration(SECURITY_CONSTRAINT_KEY, AUTH_CONSTRAINT_KEY, roles, existingAuthConstraint);
                  //ignore auth-constraint specified in web-fragments, since it's already specified in web.xml
                  if (ConfigSource.WEB_FRAGMENT == this.configurator.getConfigSource() && ConfigSource.WEB_XML == existingAuthConstraint.getSource()) {
                      return new ArrayList<String>();
                  }
              }
          }
          return roles;
      }