I found a minor bug in useradmin. In the hasRole method of the RoleImp when verifing the rule parents it always returns false:
(...)
// check if any basic parent has the role
for (Enumeration en = basicMemberOf.elements(); en.hasMoreElements();) {
RoleImpl parentGroup = (RoleImpl) en.nextElement();
System.out.println("(RoleImp) parent name:"+parentGroup.name);
if (parentGroup.hasRole(roleName, user, context, visited);) {
return true;
}
}
(...)
This happens when the parent rule is a group( the hasRule is overwriten there), so the solution is simple in the if condition instead of parentGroup.hasRole(roleName, user, context, visited), we must call parentGroup.hasRole(roleName, parentGroup.name, context, visited)