Details
Description
TomcatGeronimoRealm.hasRole sets callers which it has no business doing. These were already set during authentication. This wipes out the run-as info which was set earlier. Checking the principal is also unrelated to role checks in geronimo and should be omitted.