String servletName = servlet.getName();
String[] roleRefs = servlet.findSecurityReferences();
// Perform the unreferenced roles processing for every servlet name
for (int j = 0; j < roleRefs.length; j++) {
String roleRef = roleRefs[j];
String roleName = servlet.findSecurityReference(roleRef);
WebRoleRefPermission wrrp = new WebRoleRefPermission(servletName, roleRef);
pc.addToRole(roleName, wrrp);
/*
* A bit of a hack due to how tomcat calls out to its Realm.hasRole() with a role name that has been mapped to
* the role-link value. We may need to handle this with a custom request wrapper.