Ideally, you should be using Drools based authorization or XACML based authorization. 

When you have very simple use cases such as testing environments, then you can use the SimpleAuthorizationManager that checks the PicketBoxSubject for the configured roles.

The setter on the SimpleAuthorizationManager is:

/**
     * Set the role names
     *
     * @param roleNames
     */
    public void setRoleNames(List<String> roleNames) {
        this.roleNames = roleNames;
    }