code: private Set<String> getUserRoles(Subject subject) {
          Set<String> userRoles = null;
  
          // get roles from specified classes
          Set<Principal> principals = subject.getPrincipals();
          if (roleClassNames != null && roleClassNames.size() > 0) {
              for (Principal p : principals) {
                  if (roleClassNames.contains(p.getClass().getName())) {
                      if (userRoles == null) userRoles = new HashSet<String>();
                      userRoles.add(p.getName());
                  }
              }
          }
  
          // get roles from specified attributes
          Map<String, Set<String>> attributes =
                  SubjectUtils.getAttributes(subject);
          for (String key : attributes.keySet()) {
              if (roleAttributeNames.contains(key)) {
                  if (userRoles == null) userRoles = new HashSet<String>();
                  userRoles.addAll(attributes.get(key));
              }
          }
  
          if (userRoles == null) userRoles = Collections.emptySet();
          if (logger.isDebugEnabled()) {
              for (String r : userRoles) {
                  logger.debug("found role: {}", r);
              }
          }
  
          return userRoles;
      }
docs: Obtains the roles for the user based on the class names and attribute
  names provided in the web.xml file.
  
  @param subject
  the subject returned from authentication.
  @return a set of strings that represent the users roles.