code: private List<String> createRoles(com.ibm.ws.javaee.dd.web.common.SecurityConstraint archiveConstraint) {
          List<String> roles = new ArrayList<String>();
          AuthConstraint authConstraint = archiveConstraint.getAuthConstraint();
          if (authConstraint != null) {
              Map<String, ConfigItem<List<String>>> authConstraintMap = configurator.getConfigItemMap(AUTH_CONSTRAINT_KEY);
              String webResourceName = archiveConstraint.getWebResourceCollections().get(0).getWebResourceName();
              ConfigItem<List<String>> existingAuthConstraint = authConstraintMap.get(webResourceName);
              roles = authConstraint.getRoleNames();
              if (roles.contains(ALL_ROLES_MARKER)) {
                  roles = allRoles;
              }
              if (existingAuthConstraint == null) {
                  authConstraintMap.put(webResourceName, this.configurator.createConfigItem(roles));
              } else {
                  this.configurator.validateDuplicateConfiguration(SECURITY_CONSTRAINT_KEY, AUTH_CONSTRAINT_KEY, roles, existingAuthConstraint);
                  //ignore auth-constraint specified in web-fragments, since it's already specified in web.xml
                  if (ConfigSource.WEB_FRAGMENT == this.configurator.getConfigSource() && ConfigSource.WEB_XML == existingAuthConstraint.getSource()) {
                      return new ArrayList<String>();
                  }
              }
          }
          return roles;
      }
docs: Gets a list of roles from the auth-constraint element in web.xml and/or web-fragment.xml files.
  Note that only one auth-constraint element can be present per security-constraint. Only the first occurrence is processed.
  If multiple web fragments specify this element with different values and it's absent from the web.xml, this will result
  in an error that fails the application install.
  
  @param archiveConstraint the security-constraint
  @return a list of role names defined in the given security constraint