Use of isCallerInRole from a jsp page is failing because the (javax.security.jacc.WebRoleRefPermission jsp X) permission references the page as via the name "jsp" and there is no default mapping for this. We need to create such a permission mapping for every web.xml security-role element.