JBoss AOP security has a programmtic interface through the org.jboss.aspects.security.SecurityContext class. It has two static methods that are pretty self explanatory: getCallerPrincipal() and isCallerInRole.
import java.security.Principal;
import org.jboss.aspects.security.SecurityContext;
public class POJO
{
public void someMethod()
{
Principal p = SecurityContext.getCallerPrincipal();
if (!SecurityContext.isCallerInRole("root"))
{
throw new SecurityException("not root");
}
}
}
isCallerInRole() works off of the currently active security domain. The current security domain is set by the last piece of logic that tried authorization.