undertow/src/main/java/org/wildfly/extension/undertow/security/jacc/WarJACCService.java
@Override
    public void createPermissions(WarMetaData metaData, PolicyConfiguration pc) throws PolicyContextException {

        JBossWebMetaData jbossWebMetaData = metaData.getMergedJBossWebMetaData();
        HashMap<String, PatternInfo> patternMap = qualifyURLPatterns(jbossWebMetaData);

        List<SecurityConstraintMetaData> secConstraints = jbossWebMetaData.getSecurityConstraints();

        if (secConstraints != null) {
            for (SecurityConstraintMetaData secConstraint : secConstraints) {
                WebResourceCollectionsMetaData resourceCollectionsMetaData = secConstraint.getResourceCollections();
                UserDataConstraintMetaData userDataConstraintMetaData = secConstraint.getUserDataConstraint();

                if (resourceCollectionsMetaData != null) {
                    if (secConstraint.isExcluded() || secConstraint.isUnchecked()) {
                        // Process the permissions for the excluded/unchecked resources
                        for (WebResourceCollectionMetaData resourceCollectionMetaData : resourceCollectionsMetaData) {
                            List<String> httpMethods = new ArrayList<>(resourceCollectionMetaData.getHttpMethods());
                            List<String> ommisions = resourceCollectionMetaData.getHttpMethodOmissions();
                            if(httpMethods.isEmpty() && !ommisions.isEmpty()) {
                                httpMethods.addAll(WebResourceCollectionMetaData.ALL_HTTP_METHODS);
                                httpMethods.removeAll(ommisions);
                            }
                            List<String> urlPatterns = resourceCollectionMetaData.getUrlPatterns();
                            for (String urlPattern : urlPatterns) {
                                PatternInfo info = patternMap.get(urlPattern);
                                info.descriptor=true;
                                // Add the excluded methods
                                if (secConstraint.isExcluded()) {
                                    info.addExcludedMethods(httpMethods);
                                }

                                // SECURITY-63: Missing auth-constraint needs unchecked policy
                                if (secConstraint.isUnchecked() && httpMethods.isEmpty()) {
                                    info.isMissingAuthConstraint = true;
                                } else {
                                    info.missingAuthConstraintMethods.addAll(httpMethods);
                                }
                            }
                        }
                    } else {
                        // Process the permission for the resources x roles
                        for (WebResourceCollectionMetaData resourceCollectionMetaData : resourceCollectionsMetaData) {
                            List<String> httpMethods = new ArrayList<>(resourceCollectionMetaData.getHttpMethods());
                            List<String> methodOmissions = resourceCollectionMetaData.getHttpMethodOmissions();
                            if(httpMethods.isEmpty() && !methodOmissions.isEmpty()) {
                                httpMethods.addAll(WebResourceCollectionMetaData.ALL_HTTP_METHODS);
                                httpMethods.removeAll(methodOmissions);
                            }
                            List<String> urlPatterns = resourceCollectionMetaData.getUrlPatterns();
                            for (String urlPattern : urlPatterns) {
                                // Get the qualified url pattern
                                PatternInfo info = patternMap.get(urlPattern);
                                info.descriptor=true;
                                HashSet<String> mappedRoles = new HashSet<String>();
                                secConstraint.getAuthConstraint().getRoleNames();
                                List<String> authRoles = secConstraint.getAuthConstraint().getRoleNames();
                                for (String role : authRoles) {
                                    if ("*".equals(role)) {
                                        // The wildcard ref maps to all declared security-role names
                                        mappedRoles.addAll(jbossWebMetaData.getSecurityRoleNames());
                                    }
                                    else {
                                        mappedRoles.add(role);
                                    }
                                }
                                info.addRoles(mappedRoles, httpMethods);
                                // Add the transport to methods
                                if (userDataConstraintMetaData != null && userDataConstraintMetaData.getTransportGuarantee() != null)
                                    info.addTransport(userDataConstraintMetaData.getTransportGuarantee().name(), httpMethods);
                            }
                        }
                    }
                }
            }
        }

        JBossServletsMetaData servlets = jbossWebMetaData.getServlets();
        List<ServletMappingMetaData> mappings = jbossWebMetaData.getServletMappings();
        if(servlets != null && mappings != null) {

            Map<String, List<String>> servletMappingMap = new HashMap<>();
            for(ServletMappingMetaData mapping : mappings) {
                List<String> list = servletMappingMap.get(mapping.getServletName());
                if(list == null) {
                    servletMappingMap.put(mapping.getServletName(), list = new ArrayList<>());
                }
                list.addAll(mapping.getUrlPatterns());
            }
            if(!jbossWebMetaData.isMetadataComplete()) {
                for (JBossServletMetaData servlet : servlets) {
                    ServletSecurityMetaData security = servlet.getServletSecurity();
                    if (security != null) {
                        List<String> servletMappings = servletMappingMap.get(servlet.getServletName());
                        if (servletMappings != null) {

                            if (security.getHttpMethodConstraints() != null) {
                                for (HttpMethodConstraintMetaData s : security.getHttpMethodConstraints()) {
                                    if (s.getRolesAllowed() == null || s.getRolesAllowed().isEmpty()) {
                                        for (String urlPattern : servletMappings) {
                                            // Get the qualified url pattern
                                            PatternInfo info = patternMap.get(urlPattern);
                                            if (info.descriptor) {
                                                continue;
                                            }
                                            // Add the excluded methods
                                            if (s.getEmptyRoleSemantic() == null || s.getEmptyRoleSemantic() == EmptyRoleSemanticType.PERMIT) {
                                                info.missingAuthConstraintMethods.add(s.getMethod());
                                            } else {
                                                info.addExcludedMethods(Collections.singletonList(s.getMethod()));
                                            }
                                            // Add the transport to methods
                                            if (s.getTransportGuarantee() != null)
                                                info.addTransport(s.getTransportGuarantee().name(), Collections.singletonList(s.getMethod()));
                                        }
                                    } else {
                                        for (String urlPattern : servletMappings) {
                                            // Get the qualified url pattern
                                            PatternInfo info = patternMap.get(urlPattern);
                                            if (info.descriptor) {
                                                continue;
                                            }
                                            HashSet<String> mappedRoles = new HashSet<String>();
                                            List<String> authRoles = s.getRolesAllowed();
                                            for (String role : authRoles) {
                                                if ("*".equals(role)) {
                                                    // The wildcard ref maps to all declared security-role names
                                                    mappedRoles.addAll(jbossWebMetaData.getSecurityRoleNames());
                                                } else {
                                                    mappedRoles.add(role);
                                                }
                                            }
                                            info.addRoles(mappedRoles, Collections.singletonList(s.getMethod()));
                                            // Add the transport to methods
                                            if (s.getTransportGuarantee() != null)
                                                info.addTransport(s.getTransportGuarantee().name(), Collections.singletonList(s.getMethod()));
                                        }
                                    }
                                }
                            }
                            if (security.getRolesAllowed() == null || security.getRolesAllowed().isEmpty()) {
                                for (String urlPattern : servletMappings) {
                                    // Get the qualified url pattern
                                    PatternInfo info = patternMap.get(urlPattern);
                                    if (info.descriptor) {
                                        continue;
                                    }
                                    // Add the excluded methods
                                    if (security.getEmptyRoleSemantic() == null || security.getEmptyRoleSemantic() == EmptyRoleSemanticType.PERMIT) {
                                        info.isMissingAuthConstraint = true;
                                    } else {
                                        Set<String> methods = new HashSet<>(WebResourceCollectionMetaData.ALL_HTTP_METHODS);
                                        if (security.getHttpMethodConstraints() != null) {
                                            for (HttpMethodConstraintMetaData method : security.getHttpMethodConstraints()) {
                                                methods.remove(method.getMethod());
                                            }
                                        }
                                        info.addExcludedMethods(new ArrayList<>(methods));
                                    }
                                    // Add the transport to methods
                                    if (security.getTransportGuarantee() != null)
                                        info.addTransport(security.getTransportGuarantee().name(), Collections.emptyList());
                                }
                            } else {
                                for (String urlPattern : servletMappings) {
                                    // Get the qualified url pattern
                                    PatternInfo info = patternMap.get(urlPattern);
                                    if (info.descriptor) {
                                        continue;
                                    }
                                    HashSet<String> mappedRoles = new HashSet<String>();
                                    List<String> authRoles = security.getRolesAllowed();
                                    for (String role : authRoles) {
                                        if ("*".equals(role)) {
                                            // The wildcard ref maps to all declared security-role names
                                            mappedRoles.addAll(jbossWebMetaData.getSecurityRoleNames());
                                        } else {
                                            mappedRoles.add(role);
                                        }
                                    }
                                    info.addRoles(mappedRoles, Collections.emptyList());
                                    // Add the transport to methods
                                    if (security.getTransportGuarantee() != null)
                                        info.addTransport(security.getTransportGuarantee().name(), Collections.emptyList());
                                }
                            }
                        }
                    }
                }
            }
        }

        // Create the permissions
        for (PatternInfo info : patternMap.values()) {
            String qurl = info.getQualifiedPattern();
            if (info.isOverridden) {
                continue;
            }
            // Create the excluded permissions
            String[] httpMethods = info.getExcludedMethods();
            if (httpMethods != null) {
                // There were excluded security-constraints
                WebResourcePermission wrp = new WebResourcePermission(qurl, httpMethods);
                WebUserDataPermission wudp = new WebUserDataPermission(qurl, httpMethods, null);
                pc.addToExcludedPolicy(wrp);
                pc.addToExcludedPolicy(wudp);

            }

            // Create the role permissions
            Iterator<Map.Entry<String, Set<String>>> roles = info.getRoleMethods();
            Set<String> seenMethods = new HashSet<>();
            while (roles.hasNext()) {
                Map.Entry<String, Set<String>> roleMethods = roles.next();
                String role = roleMethods.getKey();
                Set<String> methods = roleMethods.getValue();
                seenMethods.addAll(methods);
                httpMethods = methods.toArray(new String[methods.size()]);
                pc.addToRole(role, new WebResourcePermission(qurl, httpMethods));

            }

            //there are totally 7 http methods from the jacc spec (See WebResourceCollectionMetaData.ALL_HTTP_METHOD_NAMES)
            final int NUMBER_OF_HTTP_METHODS = 7;
            // JACC 1.1: create !(httpmethods) in unchecked perms
            if(jbossWebMetaData.getDenyUncoveredHttpMethods() == null) {
                if (seenMethods.size() != NUMBER_OF_HTTP_METHODS) {
                    WebResourcePermission wrpUnchecked = new WebResourcePermission(qurl, "!"
                            + getCommaSeparatedString(seenMethods.toArray(new String[seenMethods.size()])));
                    pc.addToUncheckedPolicy(wrpUnchecked);
                }
            }
            if (jbossWebMetaData.getDenyUncoveredHttpMethods() == null) {
                // Create the unchecked permissions
                String[] missingHttpMethods = info.getMissingMethods();
                int length = missingHttpMethods.length;
                roles = info.getRoleMethods();
                if (length > 0 && !roles.hasNext()) {
                    // Create the unchecked permissions WebResourcePermissions
                    WebResourcePermission wrp = new WebResourcePermission(qurl, missingHttpMethods);
                    pc.addToUncheckedPolicy(wrp);
                } else if (!roles.hasNext()) {
                    pc.addToUncheckedPolicy(new WebResourcePermission(qurl, (String) null));
                }

                // SECURITY-63: Missing auth-constraint needs unchecked policy
                if (info.isMissingAuthConstraint) {
                    pc.addToUncheckedPolicy(new WebResourcePermission(qurl, (String) null));
                } else if (!info.allMethods.containsAll(WebResourceCollectionMetaData.ALL_HTTP_METHODS)) {
                    List<String> methods = new ArrayList<>(WebResourceCollectionMetaData.ALL_HTTP_METHODS);
                    methods.removeAll(info.allMethods);
                    pc.addToUncheckedPolicy(new WebResourcePermission(qurl, methods.toArray(new String[methods.size()])));

                }
                if (!info.missingAuthConstraintMethods.isEmpty()) {
                    pc.addToUncheckedPolicy(new WebResourcePermission(qurl, info.missingAuthConstraintMethods.toArray(new String[info.missingAuthConstraintMethods.size()])));
                }
            }

            // Create the unchecked permissions WebUserDataPermissions
            Iterator<Map.Entry<String, Set<String>>> transportConstraints = info.getTransportMethods();
            while (transportConstraints.hasNext()) {
                Map.Entry<String, Set<String>> transportMethods = transportConstraints.next();
                String transport = transportMethods.getKey();
                Set<String> methods = transportMethods.getValue();
                httpMethods = new String[methods.size()];
                methods.toArray(httpMethods);
                WebUserDataPermission wudp = new WebUserDataPermission(qurl, httpMethods, transport);
                pc.addToUncheckedPolicy(wudp);

                // If the transport is "NONE", then add an exclusive WebUserDataPermission
                // with the url pattern and null
                if ("NONE".equals(transport)) {
                    WebUserDataPermission wudp1 = new WebUserDataPermission(qurl, null);
                    pc.addToUncheckedPolicy(wudp1);
                } else {
                    // JACC 1.1: Transport is CONFIDENTIAL/INTEGRAL, add a !(http methods)
                    WebUserDataPermission wudpNonNull = new WebUserDataPermission(qurl, "!"
                            + getCommaSeparatedString(httpMethods));
                    pc.addToUncheckedPolicy(wudpNonNull);
                }
            }
        }

        Set<String> declaredRoles = jbossWebMetaData.getSecurityRoleNames();
        declaredRoles.add(ANY_AUTHENTICATED_USER_ROLE);

        /*
         * Create WebRoleRefPermissions for all servlet/security-role-refs along with all the cross product of servlets and
         * security-role elements that are not referenced via a security-role-ref as described in JACC section 3.1.3.2
         */
        JBossServletsMetaData servletsMetaData = jbossWebMetaData.getServlets();
        for (JBossServletMetaData servletMetaData : servletsMetaData) {
            Set<String> unrefRoles = new HashSet<String>(declaredRoles);
            String servletName = servletMetaData.getName();
            SecurityRoleRefsMetaData roleRefsMetaData = servletMetaData.getSecurityRoleRefs();
            // Perform the unreferenced roles processing for every servlet name
            if (roleRefsMetaData != null) {
                for (SecurityRoleRefMetaData roleRefMetaData : roleRefsMetaData) {
                    String roleRef = roleRefMetaData.getRoleLink();
                    String roleName = roleRefMetaData.getRoleName();
                    WebRoleRefPermission wrrp = new WebRoleRefPermission(servletName, roleName);
                    pc.addToRole(roleRef, wrrp);

                    // Remove the role from the unreferencedRoles
                    unrefRoles.remove(roleName);
                }
            }
            // Spec 3.1.3.2: For each servlet element in the deployment descriptor
            // a WebRoleRefPermission must be added to each security-role of the
            // application whose name does not appear as the rolename
            // in a security-role-ref within the servlet element.
            for (String unrefRole : unrefRoles) {
                WebRoleRefPermission unrefP = new WebRoleRefPermission(servletName, unrefRole);
                pc.addToRole(unrefRole, unrefP);
            }
        }

        // JACC 1.1:Spec 3.1.3.2: For each security-role defined in the deployment descriptor, an
        // additional WebRoleRefPermission must be added to the corresponding role by
        // calling the addToRole method on the PolicyConfiguration object. The
        // name of all such permissions must be the empty string, and the actions of each
        // such permission must be the role-name of the corresponding role.
        for (String role : declaredRoles) {
            WebRoleRefPermission wrrep = new WebRoleRefPermission("", role);
            pc.addToRole(role, wrrep);
        }
    }
@Override
    public void createPermissions(WarMetaData metaData, PolicyConfiguration pc) throws PolicyContextException {

        JBossWebMetaData jbossWebMetaData = metaData.getMergedJBossWebMetaData();
        HashMap<String, PatternInfo> patternMap = qualifyURLPatterns(jbossWebMetaData);

        List<SecurityConstraintMetaData> secConstraints = jbossWebMetaData.getSecurityConstraints();

        if (secConstraints != null) {
            for (SecurityConstraintMetaData secConstraint : secConstraints) {
                WebResourceCollectionsMetaData resourceCollectionsMetaData = secConstraint.getResourceCollections();
                UserDataConstraintMetaData userDataConstraintMetaData = secConstraint.getUserDataConstraint();

                if (resourceCollectionsMetaData != null) {
                    if (secConstraint.isExcluded() || secConstraint.isUnchecked()) {
                        // Process the permissions for the excluded/unchecked resources
                        for (WebResourceCollectionMetaData resourceCollectionMetaData : resourceCollectionsMetaData) {
                            List<String> httpMethods = new ArrayList<>(resourceCollectionMetaData.getHttpMethods());
                            List<String> ommisions = resourceCollectionMetaData.getHttpMethodOmissions();
                            if(httpMethods.isEmpty() && !ommisions.isEmpty()) {
                                httpMethods.addAll(WebResourceCollectionMetaData.ALL_HTTP_METHODS);
                                httpMethods.removeAll(ommisions);
                            }
                            List<String> urlPatterns = resourceCollectionMetaData.getUrlPatterns();
                            for (String urlPattern : urlPatterns) {
                                PatternInfo info = patternMap.get(urlPattern);
                                info.descriptor=true;
                                // Add the excluded methods
                                if (secConstraint.isExcluded()) {
                                    info.addExcludedMethods(httpMethods);
                                }

                                // SECURITY-63: Missing auth-constraint needs unchecked policy
                                if (secConstraint.isUnchecked() && httpMethods.isEmpty()) {
                                    info.isMissingAuthConstraint = true;
                                } else {
                                    info.missingAuthConstraintMethods.addAll(httpMethods);
                                }
                            }
                        }
                    } else {
                        // Process the permission for the resources x roles
                        for (WebResourceCollectionMetaData resourceCollectionMetaData : resourceCollectionsMetaData) {
                            List<String> httpMethods = new ArrayList<>(resourceCollectionMetaData.getHttpMethods());
                            List<String> methodOmissions = resourceCollectionMetaData.getHttpMethodOmissions();
                            if(httpMethods.isEmpty() && !methodOmissions.isEmpty()) {
                                httpMethods.addAll(WebResourceCollectionMetaData.ALL_HTTP_METHODS);
                                httpMethods.removeAll(methodOmissions);
                            }
                            List<String> urlPatterns = resourceCollectionMetaData.getUrlPatterns();
                            for (String urlPattern : urlPatterns) {
                                // Get the qualified url pattern
                                PatternInfo info = patternMap.get(urlPattern);
                                info.descriptor=true;
                                HashSet<String> mappedRoles = new HashSet<String>();
                                secConstraint.getAuthConstraint().getRoleNames();
                                List<String> authRoles = secConstraint.getAuthConstraint().getRoleNames();
                                for (String role : authRoles) {
                                    if ("*".equals(role)) {
                                        // The wildcard ref maps to all declared security-role names
                                        mappedRoles.addAll(jbossWebMetaData.getSecurityRoleNames());
                                    }
                                    else {
                                        mappedRoles.add(role);
                                    }
                                }
                                info.addRoles(mappedRoles, httpMethods);
                                // Add the transport to methods
                                if (userDataConstraintMetaData != null && userDataConstraintMetaData.getTransportGuarantee() != null)
                                    info.addTransport(userDataConstraintMetaData.getTransportGuarantee().name(), httpMethods);
                            }
                        }
                    }
                }
            }
        }

        JBossServletsMetaData servlets = jbossWebMetaData.getServlets();
        List<ServletMappingMetaData> mappings = jbossWebMetaData.getServletMappings();
        if(servlets != null && mappings != null) {

            Map<String, List<String>> servletMappingMap = new HashMap<>();
            for(ServletMappingMetaData mapping : mappings) {
                List<String> list = servletMappingMap.get(mapping.getServletName());
                if(list == null) {
                    servletMappingMap.put(mapping.getServletName(), list = new ArrayList<>());
                }
                list.addAll(mapping.getUrlPatterns());
            }
            if(!jbossWebMetaData.isMetadataComplete()) {
                for (JBossServletMetaData servlet : servlets) {
                    ServletSecurityMetaData security = servlet.getServletSecurity();
                    if (security != null) {
                        List<String> servletMappings = servletMappingMap.get(servlet.getServletName());
                        if (servletMappings != null) {

                            if (security.getHttpMethodConstraints() != null) {
                                for (HttpMethodConstraintMetaData s : security.getHttpMethodConstraints()) {
                                    if (s.getRolesAllowed() == null || s.getRolesAllowed().isEmpty()) {
                                        for (String urlPattern : servletMappings) {
                                            // Get the qualified url pattern
                                            PatternInfo info = patternMap.get(urlPattern);
                                            if (info.descriptor) {
                                                continue;
                                            }
                                            // Add the excluded methods
                                            if (s.getEmptyRoleSemantic() == null || s.getEmptyRoleSemantic() == EmptyRoleSemanticType.PERMIT) {
                                                info.missingAuthConstraintMethods.add(s.getMethod());
                                            } else {
                                                info.addExcludedMethods(Collections.singletonList(s.getMethod()));
                                            }
                                            // Add the transport to methods
                                            if (s.getTransportGuarantee() != null)
                                                info.addTransport(s.getTransportGuarantee().name(), Collections.singletonList(s.getMethod()));
                                        }
                                    } else {
                                        for (String urlPattern : servletMappings) {
                                            // Get the qualified url pattern
                                            PatternInfo info = patternMap.get(urlPattern);
                                            if (info.descriptor) {
                                                continue;
                                            }
                                            HashSet<String> mappedRoles = new HashSet<String>();
                                            List<String> authRoles = s.getRolesAllowed();
                                            for (String role : authRoles) {
                                                if ("*".equals(role)) {
                                                    // The wildcard ref maps to all declared security-role names
                                                    mappedRoles.addAll(jbossWebMetaData.getSecurityRoleNames());
                                                } else {
                                                    mappedRoles.add(role);
                                                }
                                            }
                                            info.addRoles(mappedRoles, Collections.singletonList(s.getMethod()));
                                            // Add the transport to methods
                                            if (s.getTransportGuarantee() != null)
                                                info.addTransport(s.getTransportGuarantee().name(), Collections.singletonList(s.getMethod()));
                                        }
                                    }
                                }
                            }
                            if (security.getRolesAllowed() == null || security.getRolesAllowed().isEmpty()) {
                                for (String urlPattern : servletMappings) {
                                    // Get the qualified url pattern
                                    PatternInfo info = patternMap.get(urlPattern);
                                    if (info.descriptor) {
                                        continue;
                                    }
                                    // Add the excluded methods
                                    if (security.getEmptyRoleSemantic() == null || security.getEmptyRoleSemantic() == EmptyRoleSemanticType.PERMIT) {
                                        info.isMissingAuthConstraint = true;
                                    } else {
                                        Set<String> methods = new HashSet<>(WebResourceCollectionMetaData.ALL_HTTP_METHODS);
                                        if (security.getHttpMethodConstraints() != null) {
                                            for (HttpMethodConstraintMetaData method : security.getHttpMethodConstraints()) {
                                                methods.remove(method.getMethod());
                                            }
                                        }
                                        info.addExcludedMethods(new ArrayList<>(methods));
                                    }
                                    // Add the transport to methods
                                    if (security.getTransportGuarantee() != null)
                                        info.addTransport(security.getTransportGuarantee().name(), Collections.emptyList());
                                }
                            } else {
                                for (String urlPattern : servletMappings) {
                                    // Get the qualified url pattern
                                    PatternInfo info = patternMap.get(urlPattern);
                                    if (info.descriptor) {
                                        continue;
                                    }
                                    HashSet<String> mappedRoles = new HashSet<String>();
                                    List<String> authRoles = security.getRolesAllowed();
                                    for (String role : authRoles) {
                                        if ("*".equals(role)) {
                                            // The wildcard ref maps to all declared security-role names
                                            mappedRoles.addAll(jbossWebMetaData.getSecurityRoleNames());
                                        } else {
                                            mappedRoles.add(role);
                                        }
                                    }
                                    info.addRoles(mappedRoles, Collections.emptyList());
                                    // Add the transport to methods
                                    if (security.getTransportGuarantee() != null)
                                        info.addTransport(security.getTransportGuarantee().name(), Collections.emptyList());
                                }
                            }
                        }
                    }
                }
            }
        }

        // Create the permissions
        for (PatternInfo info : patternMap.values()) {
            String qurl = info.getQualifiedPattern();
            if (info.isOverridden) {
                continue;
            }
            // Create the excluded permissions
            String[] httpMethods = info.getExcludedMethods();
            if (httpMethods != null) {
                // There were excluded security-constraints
                WebResourcePermission wrp = new WebResourcePermission(qurl, httpMethods);
                WebUserDataPermission wudp = new WebUserDataPermission(qurl, httpMethods, null);
                pc.addToExcludedPolicy(wrp);
                pc.addToExcludedPolicy(wudp);

            }

            // Create the role permissions
            Iterator<Map.Entry<String, Set<String>>> roles = info.getRoleMethods();
            Set<String> seenMethods = new HashSet<>();
            while (roles.hasNext()) {
                Map.Entry<String, Set<String>> roleMethods = roles.next();
                String role = roleMethods.getKey();
                Set<String> methods = roleMethods.getValue();
                seenMethods.addAll(methods);
                httpMethods = methods.toArray(new String[methods.size()]);
                pc.addToRole(role, new WebResourcePermission(qurl, httpMethods));

            }

            //there are totally 7 http methods from the jacc spec (See WebResourceCollectionMetaData.ALL_HTTP_METHOD_NAMES)
            final int NUMBER_OF_HTTP_METHODS = 7;
            // JACC 1.1: create !(httpmethods) in unchecked perms
            if(jbossWebMetaData.getDenyUncoveredHttpMethods() == null) {
                if (seenMethods.size() != NUMBER_OF_HTTP_METHODS) {
                    WebResourcePermission wrpUnchecked = new WebResourcePermission(qurl, "!"
                            + getCommaSeparatedString(seenMethods.toArray(new String[seenMethods.size()])));
                    pc.addToUncheckedPolicy(wrpUnchecked);
                }
            }
            if (jbossWebMetaData.getDenyUncoveredHttpMethods() == null) {
                // Create the unchecked permissions
                String[] missingHttpMethods = info.getMissingMethods();
                int length = missingHttpMethods.length;
                roles = info.getRoleMethods();
                if (length > 0 && !roles.hasNext()) {
                    // Create the unchecked permissions WebResourcePermissions
                    WebResourcePermission wrp = new WebResourcePermission(qurl, missingHttpMethods);
                    pc.addToUncheckedPolicy(wrp);
                } else if (!roles.hasNext()) {
                    pc.addToUncheckedPolicy(new WebResourcePermission(qurl, (String) null));
                }

                // SECURITY-63: Missing auth-constraint needs unchecked policy
                if (info.isMissingAuthConstraint) {
                    pc.addToUncheckedPolicy(new WebResourcePermission(qurl, (String) null));
                } else if (!info.allMethods.containsAll(WebResourceCollectionMetaData.ALL_HTTP_METHODS)) {
                    List<String> methods = new ArrayList<>(WebResourceCollectionMetaData.ALL_HTTP_METHODS);
                    methods.removeAll(info.allMethods);
                    pc.addToUncheckedPolicy(new WebResourcePermission(qurl, methods.toArray(new String[methods.size()])));

                }
                if (!info.missingAuthConstraintMethods.isEmpty()) {
                    pc.addToUncheckedPolicy(new WebResourcePermission(qurl, info.missingAuthConstraintMethods.toArray(new String[info.missingAuthConstraintMethods.size()])));
                }
            }

            // Create the unchecked permissions WebUserDataPermissions
            Iterator<Map.Entry<String, Set<String>>> transportConstraints = info.getTransportMethods();
            while (transportConstraints.hasNext()) {
                Map.Entry<String, Set<String>> transportMethods = transportConstraints.next();
                String transport = transportMethods.getKey();
                Set<String> methods = transportMethods.getValue();
                httpMethods = new String[methods.size()];
                methods.toArray(httpMethods);
                WebUserDataPermission wudp = new WebUserDataPermission(qurl, httpMethods, transport);
                pc.addToUncheckedPolicy(wudp);

                // If the transport is "NONE", then add an exclusive WebUserDataPermission
                // with the url pattern and null
                if ("NONE".equals(transport)) {
                    WebUserDataPermission wudp1 = new WebUserDataPermission(qurl, null);
                    pc.addToUncheckedPolicy(wudp1);
                } else {
                    // JACC 1.1: Transport is CONFIDENTIAL/INTEGRAL, add a !(http methods)
                    WebUserDataPermission wudpNonNull = new WebUserDataPermission(qurl, "!"
                            + getCommaSeparatedString(httpMethods));
                    pc.addToUncheckedPolicy(wudpNonNull);
                }
            }
        }

        Set<String> declaredRoles = jbossWebMetaData.getSecurityRoleNames();
        declaredRoles.add(ANY_AUTHENTICATED_USER_ROLE);

        /*
         * Create WebRoleRefPermissions for all servlet/security-role-refs along with all the cross product of servlets and
         * security-role elements that are not referenced via a security-role-ref as described in JACC section 3.1.3.2
         */
        JBossServletsMetaData servletsMetaData = jbossWebMetaData.getServlets();
        for (JBossServletMetaData servletMetaData : servletsMetaData) {
            Set<String> unrefRoles = new HashSet<String>(declaredRoles);
            String servletName = servletMetaData.getName();
            SecurityRoleRefsMetaData roleRefsMetaData = servletMetaData.getSecurityRoleRefs();
            // Perform the unreferenced roles processing for every servlet name
            if (roleRefsMetaData != null) {
                for (SecurityRoleRefMetaData roleRefMetaData : roleRefsMetaData) {
                    String roleRef = roleRefMetaData.getRoleLink();
                    String roleName = roleRefMetaData.getRoleName();
                    WebRoleRefPermission wrrp = new WebRoleRefPermission(servletName, roleName);
                    pc.addToRole(roleRef, wrrp);

                    // Remove the role from the unreferencedRoles
                    unrefRoles.remove(roleName);
                }
            }
            // Spec 3.1.3.2: For each servlet element in the deployment descriptor
            // a WebRoleRefPermission must be added to each security-role of the
            // application whose name does not appear as the rolename
            // in a security-role-ref within the servlet element.
            for (String unrefRole : unrefRoles) {
                WebRoleRefPermission unrefP = new WebRoleRefPermission(servletName, unrefRole);
                pc.addToRole(unrefRole, unrefP);
            }
        }

        // JACC 1.1:Spec 3.1.3.2: For each security-role defined in the deployment descriptor, an
        // additional WebRoleRefPermission must be added to the corresponding role by
        // calling the addToRole method on the PolicyConfiguration object. The
        // name of all such permissions must be the empty string, and the actions of each
        // such permission must be the role-name of the corresponding role.
        for (String role : declaredRoles) {
            WebRoleRefPermission wrrep = new WebRoleRefPermission("", role);
            pc.addToRole(role, wrrep);
        }
    }
{@inheritDoc}