diff --git a/jetty-security/src/main/java/org/eclipse/jetty/security/ConstraintSecurityHandler.java b/jetty-security/src/main/java/org/eclipse/jetty/security/ConstraintSecurityHandler.java
index d495e0146fe..c8daed4c992 100644
--- a/jetty-security/src/main/java/org/eclipse/jetty/security/ConstraintSecurityHandler.java
+++ b/jetty-security/src/main/java/org/eclipse/jetty/security/ConstraintSecurityHandler.java
@@ -64,6 +64,8 @@ public class ConstraintSecurityHandler extends SecurityHandler implements Constr
      * </ul>
      * 
      * @param strict the strict to set
+     * @see #setRoles(Set)
+     * @see #setConstraintMappings(ConstraintMapping[], Set)
      */
     public void setStrict(boolean strict)
     {
@@ -128,9 +130,23 @@ public class ConstraintSecurityHandler extends SecurityHandler implements Constr
                 }
             }
         }
+        setRoles(roles);
+    }
+    
+    /* ------------------------------------------------------------ */
+    /**
+     * Set the known roles.
+     * This may be overridden by a subsequent call to {@link #setConstraintMappings(ConstraintMapping[])} or
+     * {@link #setConstraintMappings(ConstraintMapping[], Set)}.
+     * @see #setStrict(boolean)
+     * @param roles The known roles (or null to determine them from the mappings)
+     */
+    public void setRoles(Set<String> roles)
+    {
+        if (isStarted())
+            throw new IllegalStateException("Started");
         
         this._roles = roles;
-
     }
 
     /* ------------------------------------------------------------ */