DefaultSecurityManager implements SecurityManager { public void addUser(String username, String password, String... roles) { logins.put(username, password); if (roles != null) { userRoles.put(username, roles); } }  void addUser(String username, String password, String... roles); void addUserRole(String username, String... roles); @Override boolean authenticate(
            HttpServletRequest request, HttpServletResponse response); @Override void declareRoles(String[] roles); @Override Set<String> getRoles(); @Override boolean getDenyUncoveredHttpMethods(); @Override WebApplication getWebApplication(); @Override boolean isUserInRole(HttpServletRequest request, String role); @Override void login(HttpServletRequest request, String username, String password); @Override void logout(HttpServletRequest request, HttpServletResponse response); void removeUser(String username); @Override void setDenyUncoveredHttpMethods(boolean denyUncoveredHttpMethods); @Override void setWebApplication(WebApplication webApplication);  }
@Test void testAddUser() { TestWebApplicationRequest request = new TestWebApplicationRequest(); request.setUserPrincipal(new UserPrincipal("username")); DefaultSecurityManager securityManager = new DefaultSecurityManager(); securityManager.addUser("username", "password", new String[]{"role1", "role2"}); assertTrue(securityManager.isUserInRole(request, "role1")); }