controller.addControlledObject( a1 );
assertFalse( "Object should not be authorized", a1.isAuthorized() );
// Now set the authentication token so that it contains one of these roles
Authentication auth = new TestingAuthenticationToken( "USER1", "FOO",
new GrantedAuthority[] { new GrantedAuthorityImpl( "ROLE_1" ) } );
controller.setAuthenticationToken( auth );
assertTrue( "Object should be authorized", a1.isAuthorized() );
assertEquals( "Object should be updated", a1.getAuthCount(), 2 );
// Now to a token that does not contain one of the roles
auth = new TestingAuthenticationToken( "USER1", "FOO", new GrantedAuthority[] { new GrantedAuthorityImpl(
"ROLE_NOTFOUND" ) } );
controller.setAuthenticationToken( auth );
assertFalse( "Object should not be authorized", a1.isAuthorized() );
assertEquals( "Object should be updated", a1.getAuthCount(), 3 );