The 4.0.2RC1 release cannot be done until the current isUserInRole failures are resolved. The problem is the integration of the custom principal from the authentication layer to the request getUserPrincpal is resulting in the tomcat GenericPrincipal being lost along with its roles.