gt:                 Collection<String> values = roleLinks.get(key);
context: /*
   * JBoss, Home of Professional Open Source.
   * Copyright (c) 2011, Red Hat, Inc., and individual contributors
   * as indicated by the @author tags. See the copyright.txt file in the
   * distribution for a full listing of individual contributors.
   *
   * This is free software; you can redistribute it and/or modify it
   * under the terms of the GNU Lesser General Public License as
   * published by the Free Software Foundation; either version 2.1 of
   * the License, or (at your option) any later version.
   *
   * This software is distributed in the hope that it will be useful,
   * but WITHOUT ANY WARRANTY; without even the implied warranty of
   * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
   * Lesser General Public License for more details.
   *
   * You should have received a copy of the GNU Lesser General Public
   * License along with this software; if not, write to the Free
   * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
   * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
   */
  package org.jboss.as.security.service;
  
  import static java.security.AccessController.doPrivileged;
  
  import java.lang.reflect.Method;
  import java.security.AccessController;
  import java.security.CodeSource;
  import java.security.Principal;
  import java.security.PrivilegedAction;
  import java.security.acl.Group;
  import java.util.Collection;
  import java.util.Enumeration;
  import java.util.HashMap;
  import java.util.HashSet;
  import java.util.Map;
  import java.util.Set;
  
  import javax.security.auth.Subject;
  import javax.security.jacc.PolicyContext;
  
  import org.jboss.as.core.security.ServerSecurityManager;
  import org.jboss.as.security.logging.SecurityLogger;
  import org.jboss.as.security.remoting.RemoteConnection;
  import org.jboss.as.security.remoting.RemotingConnectionCredential;
  import org.jboss.metadata.javaee.spec.SecurityRolesMetaData;
  import org.jboss.security.AuthenticationManager;
  import org.jboss.security.ISecurityManagement;
  import org.jboss.security.RunAs;
  import org.jboss.security.RunAsIdentity;
  import org.jboss.security.SecurityContext;
  import org.jboss.security.SecurityContextAssociation;
  import org.jboss.security.SecurityContextFactory;
  import org.jboss.security.SecurityContextUtil;
  import org.jboss.security.SecurityRolesAssociation;
  import org.jboss.security.SimplePrincipal;
  import org.jboss.security.SubjectInfo;
  import org.jboss.security.audit.AuditEvent;
  import org.jboss.security.audit.AuditLevel;
  import org.jboss.security.audit.AuditManager;
  import org.jboss.security.authorization.resources.EJBResource;
  import org.jboss.security.identity.Identity;
  import org.jboss.security.identity.plugins.SimpleIdentity;
  import org.jboss.security.identity.plugins.SimpleRoleGroup;
  import org.jboss.security.javaee.AbstractEJBAuthorizationHelper;
  import org.jboss.security.javaee.SecurityHelperFactory;
  import org.jboss.security.javaee.SecurityRoleRef;
  import org.wildfly.security.auth.server.IdentityCredentials;
  import org.wildfly.security.auth.server.SecurityDomain;
  import org.wildfly.security.auth.server.SecurityIdentity;
  import org.wildfly.security.credential.PasswordCredential;
  import org.wildfly.security.password.interfaces.ClearPassword;
  
  /**
   * @author <a href="mailto:cdewolf@redhat.com">Carlo de Wolf</a>
   * @author <a href="mailto:darran.lofthouse@jboss.com">Darran Lofthouse</a>
   */
  public class SimpleSecurityManager implements ServerSecurityManager {
      private ThreadLocalStack<SecurityContext> contexts = new ThreadLocalStack<SecurityContext>();
      /**
       * Indicates if we propagate previous SecurityContext informations to the current one or not.
       * This was introduced for WFLY-981 where we wanted to have a clean SecurityContext using only the Singleton EJB security
       * configuration and not what it might have 'inherited' in the execution stack during a Postconstruct method call.
       * @see org.jboss.as.ejb3.security.NonPropagatingSecurityContextInterceptorFactory
       */
      private boolean propagate = true;
  
      public SimpleSecurityManager() {
      }
  
      public SimpleSecurityManager(SimpleSecurityManager delegate) {
          this.securityManagement = delegate.securityManagement;
          this.propagate = false;
      }
  
      private ISecurityManagement securityManagement = null;
  
      private PrivilegedAction<SecurityContext> securityContext() {
          return new PrivilegedAction<SecurityContext>() {
              public SecurityContext run() {
                  return SecurityContextAssociation.getSecurityContext();
              }
          };
      }
  
      private SecurityContext establishSecurityContext(final String securityDomain) {
          // Do not use SecurityFactory.establishSecurityContext, its static init is broken.
          try {
              final SecurityContext securityContext = SecurityContextFactory.createSecurityContext(securityDomain);
              if (securityManagement == null)
                  throw SecurityLogger.ROOT_LOGGER.securityManagementNotInjected();
              securityContext.setSecurityManagement(securityManagement);
              SecurityContextAssociation.setSecurityContext(securityContext);
              return securityContext;
          } catch (Exception e) {
              throw SecurityLogger.ROOT_LOGGER.securityException(e);
          }
      }
  
      public void setSecurityManagement(ISecurityManagement iSecurityManagement) {
          securityManagement = iSecurityManagement;
      }
  
      public Principal getCallerPrincipal() {
          final SecurityContext securityContext = doPrivileged(securityContext());
          if (securityContext == null) {
              return getUnauthenticatedIdentity().asPrincipal();
          }
          /*
           * final Principal principal = getPrincipal(securityContext.getUtil().getSubject());
           */
          Principal principal = securityContext.getIncomingRunAs();
          if (principal == null)
              principal = getPrincipal(getSubjectInfo(securityContext).getAuthenticatedSubject());
          if (principal == null)
              return getUnauthenticatedIdentity().asPrincipal();
          return principal;
      }
  
      public Subject getSubject() {
          final SecurityContext securityContext = doPrivileged(securityContext());
          if (securityContext != null) {
              return getSubjectInfo(securityContext).getAuthenticatedSubject();
          }
          return null;
      }
  
      /**
       * Get the Principal given the authenticated Subject. Currently the first principal that is not of type {@code Group} is
       * considered or the single principal inside the CallerPrincipal group.
       *
       * @param subject
       * @return the authenticated principal
       */
      private Principal getPrincipal(Subject subject) {
          Principal principal = null;
          Principal callerPrincipal = null;
          if (subject != null) {
              Set<Principal> principals = subject.getPrincipals();
              if (principals != null && !principals.isEmpty()) {
                  for (Principal p : principals) {
                      if (!(p instanceof Group) && principal == null) {
                          principal = p;
                      }
                      if (p instanceof Group) {
                          Group g = Group.class.cast(p);
                          if (g.getName().equals("CallerPrincipal") && callerPrincipal == null) {
                              Enumeration<? extends Principal> e = g.members();
                              if (e.hasMoreElements())
                                  callerPrincipal = e.nextElement();
                          }
                      }
                  }
              }
          }
          return callerPrincipal == null ? principal : callerPrincipal;
      }
  
      @Override
      @Deprecated
      public boolean isCallerInRole(String ejbName, Object mappedRoles, Map<String, Collection<String>> roleLinks, String... roleNames) {
          return isCallerInRole(ejbName, PolicyContext.getContextID(), mappedRoles, roleLinks, roleNames);
      }
  
      /**
       * @param ejbName              The name of the EJB component where isCallerInRole was invoked.
       * @param incommingMappedRoles The principal vs roles mapping (if any). Can be null.
       * @param roleLinks            The role link map where the key is an alias role name and the value is the collection of
       *                             role names, that alias represents. Can be null.
       * @param roleNames            The role names for which the caller is being checked for
       * @return true if the user is in <b>any</b> one of the <code>roleNames</code>. Else returns false
       */
      public boolean isCallerInRole(final String ejbName, final String policyContextID, final Object incommingMappedRoles,
                                    final Map<String, Collection<String>> roleLinks, final String... roleNames) {
  
          final SecurityContext securityContext = doPrivileged(securityContext());
          if (securityContext == null) {
              return false;
          }
  
          final EJBResource resource = new EJBResource(new HashMap<String, Object>());
          resource.setEjbName(ejbName);
          resource.setPolicyContextID(policyContextID);
          resource.setCallerRunAsIdentity(securityContext.getIncomingRunAs());
          resource.setCallerSubject(securityContext.getUtil().getSubject());
          Principal userPrincipal = securityContext.getUtil().getUserPrincipal();
          resource.setPrincipal(userPrincipal);
          if (roleLinks != null) {
              final Set<SecurityRoleRef> roleRefs = new HashSet<SecurityRoleRef>();
              for (String key : roleLinks.keySet()) {
  