if (!ejbMethodSecurityMetaData.isPermitAll()) {
// get allowed roles (if any) for this method invocation
final Collection<String> allowedRoles = ejbMethodSecurityMetaData.getRolesAllowed();
if (!allowedRoles.isEmpty()) {
// call the security API to do authorization check
final SimpleSecurityManager securityManager = ejbComponent.getSecurityManager();
final EJBSecurityMetaData ejbSecurityMetaData = ejbComponent.getSecurityMetaData();
if (!securityManager.isCallerInRole(ejbSecurityMetaData.getSecurityRoles(), ejbSecurityMetaData.getSecurityRoleLinks(), allowedRoles.toArray(new String[allowedRoles.size()]))) {
throw MESSAGES.invocationOfMethodNotAllowed(invokedMethod,ejbComponent.getComponentName());
}
}
}
// successful authorization, let the invocation proceed