The method SecurityDomain.isUserInRoll should be SecurityDomain.isUserInRole , unless the intention is that a user is a) in a rolling formation (usually for air craft) or b) has been stuffed into a bakery roll