public boolean authorize(AuthenticationResult authResult, String appName, String uriName, Subject previousCaller, List<String> requiredRoles) {
        // Set the authorized subject on the thread
        subjectManager.setCallerSubject(authResult.getSubject());
        boolean isAuthorized = authorize(authResult, appName, uriName, requiredRoles);
        if (isAuthorized) {
            // at this point set invocation subject = caller subject.
            // delegation may change the invocation subject later
            subjectManager.setInvocationSubject(authResult.getSubject());
        } else {
            subjectManager.setCallerSubject(previousCaller);
        }
        return isAuthorized;
    }
public boolean authorize ( AuthenticationResult authResult , String appName , String uriName , Subject previousCaller , List < String > requiredRoles ) { subjectManager . setCallerSubject ( authResult . getSubject ( ) ) ; boolean isAuthorized = authorize ( authResult , appName , uriName , requiredRoles ) ; if ( isAuthorized ) { subjectManager . setInvocationSubject ( authResult . getSubject ( ) ) ; } else { subjectManager . setCallerSubject ( previousCaller ) ; } return isAuthorized ; }
Call the authorization service to determine if the subject is authorized to the given roles

@param authResult the authentication result, containing the subject, user name and realm
@param appName the name of the application, used to look up the correct authorization table
@param uriName the uri being accessed
@param previousCaller the previous caller, used to restore the previous state if authorization fails
@param requiredRoles the roles required to access the resource
@return true if the subject is authorized, otherwise false