class DatawavePrincipalLoginModule extends AbstractServerLoginModule {

    @Override
    protected Group[] getRoleSets() throws LoginException {
        Group groups[];
        try {
            Set<String> roles = new TreeSet<>();
            String targetUser = getUsername();
            DatawavePrincipal principal = (DatawavePrincipal) getIdentity();
            
            Collection<String> cpRoleSets = principal.getPrimaryUser().getRoles();
            if (cpRoleSets != null) {
                roles.addAll(cpRoleSets);
                // We are requiring that at every entity in the call chain has at least one of the required roles.
                // If any entity has none of them, then exclude all of the required roles from the computed final set.
                if (principal.getProxiedUsers().stream().anyMatch(u -> Collections.disjoint(u.getRoles(), requiredRoles))) {
                    roles.removeAll(requiredRoles);
                }
            }
            StringBuilder buf = new StringBuilder("[" + roles.size() + "] Groups for " + targetUser + " {");
            if (!roles.isEmpty()) {
                Group group = new SimpleGroup("Roles");
                boolean first = true;
                for (String r : roles)
                    try {
                        if (!first) {
                            buf.append(":");
                        }
                        first = false;
                        group.addMember(new SimplePrincipal(r));
                        buf.append(" ").append(r).append(" ");
                    } catch (Exception e) {
                        log.debug("Failed to create principal for: " + r, e);
                    }
                
                groups = new Group[2];
                groups[0] = group;
                groups[1] = new SimpleGroup("CallerPrincipal");
                groups[1].addMember(getIdentity());
            } else {
                groups = new Group[0];
            }
            buf.append("}");
            log.debug(buf.toString());
        } catch (RuntimeException e) {
            groups = new Group[0];
            log.warn("Exception in getRoleSets: " + e.getMessage(), e);
            abort();
        }
        return groups;
    }

    public  DatawavePrincipalLoginModule();

}