Subject subject = (Subject) PolicyContext.getContext("javax.security.auth.Subject.container");
 
boolean hasAccess = Policy.getPolicy().implies(
    new ProtectionDomain(
        new CodeSource(null, (Certificate[]) null),
        null, null, 
        subject.getPrincipals().toArray(new Principal[subject.getPrincipals().size()])
    ),
    new WebResourcePermission("/protected/Servlet", "GET"))
;

String[] rolesArray = groupPrincipalCallback.getGroups();
int sizeOfRoles = rolesArray != null ? rolesArray.length : 0;
 
if( sizeOfRoles > 0 )
{
  List<Role> rolesList = new ArrayList<Role>();
  for( int i = 0; i < sizeOfRoles ; i++ )
  {
     Role role = new SimpleRole( rolesArray[ i ] );
     rolesList.add( role );
  }
  RoleGroup roles = new SimpleRoleGroup( SecurityConstants.ROLES_IDENTIFIER, rolesList );

  // if the current security context already has roles, we merge them with the incoming roles.
  RoleGroup currentRoles = currentSC.getUtil().getRoles();

  // *** ROLES ARE ONLY SET HERE ***
  if (currentRoles != null) {
      currentRoles.addAll(roles.getRoles());
  }
  else {
      currentSC.getUtil().setRoles( roles );
  }
} 

// *** BELOW THIS LINE ROLES ARE NOT REFERENCED ANYMORE
// *** SUBJECT IS NOT POPULATED WITH ANY ROLE INFO 

Subject subject = groupPrincipalCallback.getSubject();
if( subject != null )
{
   // if the current security context already has an associated subject, we merge it with the incoming subject.
   Subject currentSubject = currentSC.getSubjectInfo().getAuthenticatedSubject();
   if (currentSubject != null) {
       subject.getPrincipals().addAll(currentSubject.getPrincipals());
       subject.getPublicCredentials().addAll(currentSubject.getPublicCredentials());
       subject.getPrivateCredentials().addAll(currentSubject.getPrivateCredentials());
   }
   currentSC.getSubjectInfo().setAuthenticatedSubject(subject);
}