code: public void setAuthorizingRoles(String roles) {
          // The ConfigAttributeEditor is named incorrectly, so you can't use it
          // to automatically convert the string to a ConfigAttributeDefinition.
          // So, we do it manually :-(
  
          ConfigAttributeEditor editor = new ConfigAttributeEditor();
          editor.setAsText( roles );
          this.roles = (List<ConfigAttribute>) editor.getValue();
          rolesString = roles;
      }
docs: Set the roles to compare against the current user's authenticated roles. The
  secured objects will be authorized if the user holds one or more of these roles.
  This should be specified as a simple list of comma separated role names.
  @param roles