code: private void addRolesToSubject(Subject subject, Set<String> userRoles) {
          if (userRoles == null) {
              userRoles = Collections.emptySet();
          }
  
          Map<String, Set<String>> attributes =
                  SubjectUtils.getAttributes(subject);
  
          Set<String> roles = attributes.get(ROLE_KEY);
          if (roles == null) {
              roles = new HashSet<String>(userRoles);
              attributes.put(ROLE_KEY, roles);
          } else {
              roles.addAll(userRoles);
          }
          if (logger.isDebugEnabled()) {
              for (String role : userRoles) {
                  logger.debug("added role: {}", role);
              }
          }
      }
docs: Adds roles to the Subject object.
  
  @param subject
  the subject that was returned from authentication.
  @param userRoles
  the set of user roles that were found.