isUserInRole() uses a SecurityContext request that your authenticator must set. The SecurityContext interface does not provide a method that allows you to access this information, but you can do something in your authenticator to make the information available as a provider or add it as a request attribute and access it in this way.
source share