Default Authorization Provider

Question

Is it possible to obtain the authorization provider? I need to check if a user is
in a role using the AccessDecision.isAccessAllowed().
I realize that we can call isUserInRole() and similar method on the HttpRequest and
EJBContext, but I am trying to port a pre WL7.0 custom realm, which used ACLs, with
no impact on bean or sevlet code. I am looking for somthing analogous to weblogic.security.acl.Security.hasPermission(java.security.Principal
principal, java.lang.String aclName, java.security.acl.Permission permission, char
sep).
Thanks, Ziad--

Answer 1

I see 2 approaches. First, write a custom authenticator that stores the role information in the subject either by creating a custom java.security.Principal that is stored in the Subject or by saving it in PrivateCredentials of the Subject. Then right a custom role mapper that knows how to get the role information from the Subject and return a role Map. The default XACML Authorizer will then work with the role information in the role map.
Second approach is to write a custom role mapper that looks up the role information based on the Subject and returns a role map.
The chosen approach depends on where you're getting the role information from.