public boolean authorize ( AuthenticationResult authResult , String appName , String uriName , Subject previousCaller , List < String > requiredRoles ) { // Set the authorized subject on the thread subjectManager . setCallerSubject ( authResult . getSubject ( ) ) ; boolean isAuthorized = authorize ( authResult , appName , uriName , requiredRoles ) ; if ( isAuthorized ) { // at this point set invocation subject = caller subject. // delegation may change the invocation subject later subjectManager . setInvocationSubject ( authResult . getSubject ( ) ) ; } else { subjectManager . setCallerSubject ( previousCaller ) ; } return isAuthorized ; }
Call the authorization service to determine if the subject is authorized to the given roles