It looks to me like the AbstractServerLoginModule's roles grouping method is incompatible with tomcat.

In the commit() method, there's this little bit of code:

if( subjectGroup instanceof NestableGroup )
{
 /* A NestableGroup only allows Groups to be added to it so we
 need to add a SimpleGroup to subjectRoles to contain the roles */
 SimpleGroup tmp = new SimpleGroup("Roles");
 subjectGroup.addMember(tmp);
 subjectGroup = tmp;
}

Tomcat doesn't see the roles in the NestableGroup. So I have overridden the create() method so that I produce SimpleGroups instead of Nestables.

Is this expected behaviour? Are NestedGroups for some non-tomcat / non-web authentication & authorisation model?

Thanks,
Adam