diff --git a/appserver/web/web-core/src/main/java/org/apache/catalina/realm/JAASRealm.java b/appserver/web/web-core/src/main/java/org/apache/catalina/realm/JAASRealm.java
index bec861c84c3..56698040e0a 100644
--- a/appserver/web/web-core/src/main/java/org/apache/catalina/realm/JAASRealm.java
+++ b/appserver/web/web-core/src/main/java/org/apache/catalina/realm/JAASRealm.java
@@ -55,11 +55,13 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-// Portions Copyright [2019] Payara Foundation and/or affiliates
+// Portions Copyright [2019-2024] Payara Foundation and/or affiliates
+// Payara Foundation and/or its affiliates elects to include this software in this distribution under the GPL Version 2 license
 
 package org.apache.catalina.realm;
 
 
+import com.sun.enterprise.security.GroupPrincipal;
 import org.apache.catalina.Container;
 import org.apache.catalina.LifecycleException;
 import org.apache.catalina.LogFacade;
@@ -67,7 +69,6 @@
 import javax.security.auth.Subject;
 import javax.security.auth.login.*;
 import java.security.Principal;
-import java.security.acl.Group;
 import java.text.MessageFormat;
 import java.util.ArrayList;
 import java.util.Enumeration;
@@ -438,15 +439,13 @@ protected Principal createPrincipal(String username, Subject subject) {
                 roles.add(principal.getName());
             }
             // Same as Jboss - that's a pretty clean solution
-            if( (principal instanceof Group) &&
-                    "Roles".equals( principal.getName())) {
-                Group grp=(Group)principal;
-                Enumeration en=grp.members();
-                while( en.hasMoreElements() ) {
-                    Principal roleP=(Principal)en.nextElement();
-                    roles.add( roleP.getName());
+            if ((principal instanceof GroupPrincipal) && "Roles".equals(principal.getName())) {
+                GroupPrincipal grp = (GroupPrincipal) principal;
+                Enumeration<? extends Principal> membersEnum = grp.members();
+                while (membersEnum.hasMoreElements()) {
+                    Principal roleP = membersEnum.nextElement();
+                    roles.add(roleP.getName());
                 }
-
             }
         }
 
diff --git a/nucleus/security/core/src/main/java/com/sun/enterprise/security/GroupPrincipal.java b/nucleus/security/core/src/main/java/com/sun/enterprise/security/GroupPrincipal.java
new file mode 100644
index 00000000000..17559ae559d
--- /dev/null
+++ b/nucleus/security/core/src/main/java/com/sun/enterprise/security/GroupPrincipal.java
@@ -0,0 +1,51 @@
+/*
+ * Copyright (c) 2021 Contributors to Eclipse Foundation. All rights reserved.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0, which is available at
+ * http://www.eclipse.org/legal/epl-2.0.
+ *
+ * This Source Code may also be made available under the following Secondary
+ * Licenses when the conditions for such availability set forth in the
+ * Eclipse Public License v. 2.0 are satisfied: GNU General Public License,
+ * version 2 with the GNU Classpath Exception, which is available at
+ * https://www.gnu.org/software/classpath/license.html.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR GPL-2.0 WITH Classpath-exception-2.0
+ */
+package com.sun.enterprise.security;
+
+import java.security.Principal;
+import java.util.Enumeration;
+
+/**
+ * A group of principals.
+ *
+ * @author Arjan Tijms
+ *
+ */
+public interface GroupPrincipal extends Principal {
+
+    /**
+     * Returns true when the given principal is in this group.
+     *
+     * <p>
+     * A recursive search is done, meaning that if a principal is in a group which is itself in this group, the result is true.
+     *
+     * @param principal the principal for which we check to be in this group.
+     *
+     * @return true if the principal is in this group, false otherwise.
+     */
+    boolean isMember(Principal principal);
+
+    /**
+     * Returns an enumeration of all the principals in this group.
+     *
+     * <p>
+     * The returned principals can include principals that are besides instanced of Principal also instances of GroupPrincipal.
+     *
+     * @return an enumeration of principals in this group, potentially including nested group principals.
+     */
+    Enumeration<? extends Principal> members();
+
+}