web/src/main/java/org/springframework/security/web/authentication/preauth/j2ee/WebXmlMappableAttributesRetriever.java
public void afterPropertiesSet() throws Exception {
		Resource webXml = resourceLoader.getResource("/WEB-INF/web.xml");
		Document doc = getDocument(webXml.getInputStream());
		NodeList webApp = doc.getElementsByTagName("web-app");
		if (webApp.getLength() != 1) {
			throw new IllegalArgumentException(
					"Failed to find 'web-app' element in resource" + webXml);
		}
		NodeList securityRoles = ((Element) webApp.item(0))
				.getElementsByTagName("security-role");

		ArrayList<String> roleNames = new ArrayList<>();

		for (int i = 0; i < securityRoles.getLength(); i++) {
			Element secRoleElt = (Element) securityRoles.item(i);
			NodeList roles = secRoleElt.getElementsByTagName("role-name");

			if (roles.getLength() > 0) {
				String roleName = ((Element) roles.item(0)).getTextContent().trim();
				roleNames.add(roleName);
				logger.info("Retrieved role-name '" + roleName + "' from web.xml");
			}
			else {
				logger.info("No security-role elements found in " + webXml);
			}
		}

		mappableAttributes = Collections.unmodifiableSet(new HashSet<>(roleNames));
	}
public void afterPropertiesSet() throws Exception {
		Resource webXml = resourceLoader.getResource("/WEB-INF/web.xml");
		Document doc = getDocument(webXml.getInputStream());
		NodeList webApp = doc.getElementsByTagName("web-app");
		if (webApp.getLength() != 1) {
			throw new IllegalArgumentException(
					"Failed to find 'web-app' element in resource" + webXml);
		}
		NodeList securityRoles = ((Element) webApp.item(0))
				.getElementsByTagName("security-role");

		ArrayList<String> roleNames = new ArrayList<>();

		for (int i = 0; i < securityRoles.getLength(); i++) {
			Element secRoleElt = (Element) securityRoles.item(i);
			NodeList roles = secRoleElt.getElementsByTagName("role-name");

			if (roles.getLength() > 0) {
				String roleName = ((Element) roles.item(0)).getTextContent().trim();
				roleNames.add(roleName);
				logger.info("Retrieved role-name '" + roleName + "' from web.xml");
			}
			else {
				logger.info("No security-role elements found in " + webXml);
			}
		}

		mappableAttributes = Collections.unmodifiableSet(new HashSet<>(roleNames));
	}
Loads the web.xml file using the configured <tt>ResourceLoader</tt> and parses the
role-name elements from it, using these as the set of <tt>mappableAttributes</tt>.