I can be dead wrong but *loginName.get()* will return "John" and *UserRoles.ADMIN* "admin". Are we comparing usernames with roles? This is odd at first glance.