I think the user should be able to specify a comma-separated list of roles instead of a single role like this: <req:isUserInRole role="role1,admin"> The remote user is in role "role1" or in role "admin". </req:isUserInRole> <req:isUserInRole role="role1,admin" value="false"> The remote user is neither in role "role1" nor in role "admin". </req:isUserInRole> There currently really is no clean way to do a check like this. The attached patches add this capability and also update the documentation (or at least the documentation I could find). I also considered that a more complex syntax with parantheses, and operators for AND, OR, and NOT could be useful, but decided they weren't really necessary. NOT can be simulated using the value="" attribute, and AND can be simulated by nesting multiple <req:isUserInRole> tags within each-other. I also think a mini expression language like this would be overkill for this tag which is currently very simple.
Created attachment 8037 [details] Patch for isUserInRoleTag.java
Created attachment 8038 [details] Patch for xml\request.xml (documentation for the tag)
added PatchAvailable keywords and [PATCH] to subject line
Thank you for suggesting this enhancement and providing a patch. IMO, it is a useful suggestion. However, the request taglib has been deprecated, we do not expect any development around it in the near future.