As discussed in Bug 63982, there is no good use for Realm#getRoles(Principal). It shall be deprecated and removed in Tomcat 10.
Fixed in: - master for 9.0.30 onwards - 8.5.x for 8.5.50 onwards