@Override
    public boolean authorize(AuthenticationResult authResult, WebRequest webRequest, String uriName) {
        HttpServletRequest req = webRequest.getHttpServletRequest();
        boolean isAuthorized = jaccServiceRef.getService().isAuthorized(getApplicationName(), getModuleName(), uriName, req.getMethod(), req, authResult.getSubject());
        //String[] methodNameArray = new String[] { req.getMethod() };
        //WebResourcePermission webPerm = new WebResourcePermission(uriName, methodNameArray);
        WebReply reply = isAuthorized ? new PermitReply() : DENY_AUTHZ_FAILED;

        if (isAuthorized) {
            AuditAuthenticationResult auditAuthResult = new AuditAuthenticationResult(AuditAuthResult.SUCCESS, authResult.getSubject(), AuditEvent.CRED_TYPE_BASIC, null, AuditEvent.OUTCOME_SUCCESS);
            Audit.audit(Audit.EventID.SECURITY_AUTHZ_02, webRequest, authResult, uriName, AuditConstants.WEB_CONTAINER, Integer.valueOf(reply.getStatusCode()));
        } else {
            AuditAuthenticationResult auditAuthResult = new AuditAuthenticationResult(AuditAuthResult.FAILURE, authResult.getSubject(), AuditEvent.CRED_TYPE_BASIC, null, AuditEvent.OUTCOME_FAILURE);
            Audit.audit(Audit.EventID.SECURITY_AUTHZ_02, webRequest, authResult, uriName, AuditConstants.WEB_CONTAINER, Integer.valueOf(reply.getStatusCode()));

        }

        if (!isAuthorized) {
            String authUserName = authResult.getUserName();
            String authRealm = authResult.getRealm();
            String appName = webRequest.getApplicationName();
            if (authRealm != null && authUserName != null) {
                Tr.audit(tc, "SEC_JACC_AUTHZ_FAILED", authUserName.concat(":").concat(authRealm), appName, uriName);
            } else {
                // We have a subject if we got this far, use it to determine the name
                authUserName = authResult.getSubject().getPrincipals(WSPrincipal.class).iterator().next().getName();
                //WebReply reply = isAuthorized ? new PermitReply() : DENY_AUTHZ_FAILED;
                Tr.audit(tc, "SEC_JACC_AUTHZ_FAILED", authUserName, appName, uriName);
            }
            //WebReply reply = isAuthorized ? new PermitReply() : DENY_AUTHZ_FAILED;
            //Audit.audit(Audit.EventID.SECURITY_AUTHZ_01, webRequest, authResult, uriName, Integer.valueOf(reply.getStatusCode()));

        }
        return isAuthorized;
    }
@ Override public boolean authorize ( AuthenticationResult authResult , WebRequest webRequest , String uriName ) { HttpServletRequest req = webRequest . getHttpServletRequest ( ) ; boolean isAuthorized = jaccServiceRef . getService ( ) . isAuthorized ( getApplicationName ( ) , getModuleName ( ) , uriName , req . getMethod ( ) , req , authResult . getSubject ( ) ) ; WebReply reply = isAuthorized ? new PermitReply ( ) : DENY_AUTHZ_FAILED ; if ( isAuthorized ) { AuditAuthenticationResult auditAuthResult = new AuditAuthenticationResult ( AuditAuthResult . SUCCESS , authResult . getSubject ( ) , AuditEvent . CRED_TYPE_BASIC , null , AuditEvent . OUTCOME_SUCCESS ) ; Audit . audit ( Audit . EventID . SECURITY_AUTHZ_02 , webRequest , authResult , uriName , AuditConstants . WEB_CONTAINER , Integer . valueOf ( reply . getStatusCode ( ) ) ) ; } else { AuditAuthenticationResult auditAuthResult = new AuditAuthenticationResult ( AuditAuthResult . FAILURE , authResult . getSubject ( ) , AuditEvent . CRED_TYPE_BASIC , null , AuditEvent . OUTCOME_FAILURE ) ; Audit . audit ( Audit . EventID . SECURITY_AUTHZ_02 , webRequest , authResult , uriName , AuditConstants . WEB_CONTAINER , Integer . valueOf ( reply . getStatusCode ( ) ) ) ; } if ( ! isAuthorized ) { String authUserName = authResult . getUserName ( ) ; String authRealm = authResult . getRealm ( ) ; String appName = webRequest . getApplicationName ( ) ; if ( authRealm != null && authUserName != null ) { Tr . audit ( tc , "SEC_JACC_AUTHZ_FAILED" , authUserName . concat ( ":" ) . concat ( authRealm ) , appName , uriName ) ; } else { authUserName = authResult . getSubject ( ) . getPrincipals ( WSPrincipal . class ) . iterator ( ) . next ( ) . getName ( ) ; Tr . audit ( tc , "SEC_JACC_AUTHZ_FAILED" , authUserName , appName , uriName ) ; } } return isAuthorized ; }
Call the JACC authorization service to determine if the subject is authorized

@param authResult the authentication result, containing the subject, user name and realm
@param uriName the uri being accessed
@param previousCaller the previous caller, used to restore the previous state if authorization fails
@return true if the subject is authorized, otherwise false