!!!SecurityContext

JBoss AOP security has a programmtic interface through the {{org.jboss.aspects.security.SecurityContext}} class.  It has two static methods that are pretty self explanatory: {{getCallerPrincipal()}} and {{isCallerInRole}}.

!Example
{{{
import java.security.Principal;
import org.jboss.aspects.security.SecurityContext;

public class POJO
{
  public void someMethod() 
  {
    Principal p = SecurityContext.getCallerPrincipal();

    if (!SecurityContext.isCallerInRole("root"))
    {
       throw new SecurityException("not root");
    }
  }
}
}}}

{{isCallerInRole()}} works off of the currently active security domain.  The current security domain is set by the last piece of logic that tried authorization.
