// Which user principal have we already authenticated?
Principal principal =
((HttpServletRequest) request.getRequest()).getUserPrincipal();
for(int i=0; i < constraints.length; i++) {
SecurityConstraint constraint = constraints[i];
String roles[] = constraint.findAuthRoles();
if (roles == null)
roles = new String[0];
if (constraint.getAllRoles())
return (true);