We're seeing a problem in JBoss-2.4.3_Tomcat-3.2.3 where HttpServletRequest@.isUserInRole(String):boolean is returning an incorrect boolean per what roles are set via our LoginModule (or JBoss'!).
I am attaching a zip file (rolestest.zip) that contains very detailed information on the problem (README.txt) and a runnable test case. Unfortunately, you won't see the problem unless you can hit the test app with a load-testing tool like Empirix e-Load or Mercury Interactive LoadRunner.
Even though JBoss is already at 3.0, I think this is something that would interest them. I have not tested it under 3.0 to see if the problem still exists there or not. I am also not sure if it is JBoss' problem or Tomcat's. We don't *think* it's our code since we wrote a completely new test app (a VERY simple one) that reproduces it. It even rears it's ugly head using one of JBoss' example LoginModules and not ours.
I will also be linking to this page from the JBoss list, a Tomcat list, and a Tomcat forum.
Thanks everyone,
David
