405535 implement Request.isUserInRole(role) check security-role-refs defaulting to security-role if no matching ref

1 files changed, 9 insertions, 3 deletions

diff --git a/jetty-security/src/main/java/org/eclipse/jetty/security/DefaultUserIdentity.java b/jetty-security/src/main/java/org/eclipse/jetty/security/DefaultUserIdentity.java
index 28b0cb3a44..dd12b1d911 100644
--- a/jetty-security/src/main/java/org/eclipse/jetty/security/DefaultUserIdentity.java
+++ b/jetty-security/src/main/java/org/eclipse/jetty/security/DefaultUserIdentity.java
@@ -54,13 +54,19 @@ public class DefaultUserIdentity implements UserIdentity
     }
 
     public boolean isUserInRole(String role, Scope scope)
-    {
+    {  
         if (scope!=null && scope.getRoleRefMap()!=null)
-            role=scope.getRoleRefMap().get(role);
-
+        {
+            String mappedRole = scope.getRoleRefMap().get(role);
+            if (mappedRole != null)
+                role = mappedRole;
+        }
+        
         for (String r :_roles)
+        {
             if (r.equals(role))
                 return true;
+        }
         return false;
     }