code: public synchronized boolean isUserInRole(Principal user, String roleName)
      {
          if (user instanceof WrappedUser)
              return ((WrappedUser)user).isUserInRole(roleName);
           
          if (user==null || ((User)user).getUserRealm()!=this)
              return false;
          
          HashSet userSet = (HashSet)_roles.get(roleName);
          return userSet!=null && userSet.contains(user.getName());
      }
docs: Check if a user is in a role.
  @param user The user, which must be from this realm
  @param roleName
  @return True if the user can act in the role.