Yes please read the section "PLT.20.3 Programmatic Security"
of the portlet spec.


You must define the role Administrator in your portlet.xml descriptor.

I am having problems with the same thing, actually.

web.xml contains:

<security-role>
 <description/>
 <role-name>Administrators</role-name>
</security-role>
<security-role>
 <description/>
 <role-name>Users</role-name>
</security-role>

<security-role-ref>
 <role-name>Users</role-name>
 <role-link>Users</role-link>
</security-role-ref>
<security-role-ref>
 <role-name>Administrators</role-name>
 <role-link>Administrators</role-link>
</security-role-ref>

if(request.isUserInRole("Administrators"))
 System.out.println("Administrators");
else if(request.isUserInRole("Users"))
 System.out.println("Users");
else
 System.out.println("user is in an unknown role");

D'OH! Forgot that there is both a role-name and a display role-name. I was going by the display role-names in the provided Role Management portlet.

Sorry for the stupidity and waste of forum space.


--Andrew