I have a portlet with

<t:commandLink ... enabledOnUserRole="User">

I've created user, gave him 'User' role in Identity Management Portlet, logged in as this user, visited portlets's page, but command link was disabled. What's wrong?

Using debug I can see that my user's principal has needed roles in FacesContext.