jetty-12 SecurityHandler role checking with * not correct

[janbartel]

jetty-12 ee10 (TODO: check ee9)

SecurityHandler.isNotAuthorized doesn't correctly interpret the following security constraint as permitting access to a user who has been authenticated and is known to be in at least one role:

   <security-constraint>
    <web-resource-collection>
      <web-resource-name>MySecureBit6</web-resource-name>
      <url-pattern>/allRolesTest</url-pattern>
    </web-resource-collection>
    <auth-constraint>
      <role-name>Administrator</role-name>
      <role-name>*</role-name>
    </auth-constraint>
    <user-data-constraint>
      <transport-guarantee>NONE</transport-guarantee>
    </user-data-constraint>
  </security-constraint>

The user in question has the following roles: VP, Manager.

There is a role-mapping for VP -> VP.

The user is correctly authenticated, however according to the spec, if a constraint has a mix of specific roles and *, then * wins and the user can be in any role.

TCK test in question: *com/sun/ts/tests/servlet/spec/security/secform/Client.java.test11 *

[janbartel]

Fixed