diff --git a/server/src/main/java/org/kaazing/gateway/server/context/resolve/GatewayContextResolver.java b/server/src/main/java/org/kaazing/gateway/server/context/resolve/GatewayContextResolver.java
index <HASH>..<HASH> 100644
--- a/server/src/main/java/org/kaazing/gateway/server/context/resolve/GatewayContextResolver.java
+++ b/server/src/main/java/org/kaazing/gateway/server/context/resolve/GatewayContextResolver.java
@@ -537,15 +537,8 @@ public class GatewayContextResolver {
             for (AuthorizationConstraintType authConstraint : serviceConfig.getAuthorizationConstraintArray()) {
                 Collections.addAll(requireRolesCollection, authConstraint.getRequireRoleArray());
             }
-            RealmContext realmContext = null;
-            String name = serviceConfig.getRealmName();
-            if (serviceConfig.isSetRealmName()) {
-                realmContext = realmsContext.getRealmContext(name);
-                if (realmContext != null && !name.equals("auth-required")) {
-                    if (requireRolesCollection.isEmpty()) {
-                        Collections.addAll(requireRolesCollection, "*");
-                    }
-                }
+            if (requireRolesCollection.isEmpty()) {
+                requireRolesCollection.add("*");
             }
             String[] requireRoles = requireRolesCollection.toArray(new String[requireRolesCollection.size()]);
default require-role to "*" even for multiple http realms

- remove check for "auth-required" realm name, which was bypassing
gateway security