code: @SuppressWarnings({ "rawtypes", "unchecked" })
      GenericPrincipal createGenericPrincipal(String username, String password, List<String> roles) {
          Class klass = null;
          try {
              klass = Class.forName("org.apache.catalina.realm.GenericPrincipal");
          } catch (ClassNotFoundException ex) {
              LOGR.log(Level.SEVERE, ex.getMessage());
              // Fortify Mod: If klass is not populated, then there is no point in continuing
              return null;
          }
          Constructor[] ctors = klass.getConstructors();
          Class firstParamType = ctors[0].getParameterTypes()[0];
          Class[] paramTypes = new Class[] { Realm.class, String.class, String.class, List.class };
          Object[] ctorArgs = new Object[] { this, username, password, roles };
          GenericPrincipal principal = null;
          try {
              if (Realm.class.isAssignableFrom(firstParamType)) {
                  // Tomcat 6
                  Constructor ctor = klass.getConstructor(paramTypes);
                  principal = (GenericPrincipal) ctor.newInstance(ctorArgs);
              } else {
                  // Realm parameter removed in Tomcat 7
                  Constructor ctor = klass.getConstructor(Arrays.copyOfRange(paramTypes, 1, paramTypes.length));
                  principal = (GenericPrincipal) ctor.newInstance(Arrays.copyOfRange(ctorArgs, 1, ctorArgs.length));
              }
          } catch (Exception ex) {
              LOGR.log(Level.WARNING, ex.getMessage());
          }
          return principal;
      }
docs: Creates a new GenericPrincipal representing the specified user.
  
  @param username
  The username for this user.
  @param password
  The authentication credentials for this user.
  @param roles
  The set of roles (specified using String values) associated
  with this user.
  @return A GenericPrincipal for use by this Realm implementation.