The 'PrincipleVsRoleMapping' Collection is not related and the value iterated by the for loop is not actually used, instead just add all roles if the wildcard is detected.
The users Principal should not be used in a role membership check.
Also treat the trailing '/' matches as wildcard matches.
host header can have port
Use UT instead of UNDERTOW as the project code