docs: @Override
      public void authorizeEJB(EJBRequestData request, Subject subject) throws EJBAccessDeniedException {
          EJBMethodMetaData methodMetaData = request.getEJBMethodMetaData();
          String authzUserName = subject.getPrincipals(WSPrincipal.class).iterator().next().getName();
          String applicationName = getApplicationName(methodMetaData);
          String methodName = methodMetaData.getMethodName();//TODO: which API to call? methodInfo.getMethodSignature()+":"+methodInfo.getInterfaceType().getValue();
  
          Object req = (auditManager != null) ? auditManager.getHttpServletRequest() : null;
          Object webRequest = (auditManager != null) ? auditManager.getWebRequest() : null;
          String realm = (auditManager != null) ? auditManager.getRealm() : null;
  
          populateAuditEJBHashMap(request);
  
          Collection<String> roles = getRequiredRoles(methodMetaData);
  
          //check if bean method is excluded
          if (methodMetaData.isDenyAll()) {
              ejbAuditHashMap.put(AuditEvent.REASON_TYPE, AuditEvent.REASON_TYPE_EJB_DENYALL);
              Tr.audit(tc, "EJB_AUTHZ_EXCLUDED", authzUserName, methodName, applicationName);
              AuditAuthenticationResult auditAuthResult = new AuditAuthenticationResult(AuditAuthResult.FAILURE, authzUserName, AuditEvent.CRED_TYPE_BASIC, null, AuditEvent.OUTCOME_FAILURE);
              Audit.audit(Audit.EventID.SECURITY_AUTHZ_04, auditAuthResult, ejbAuditHashMap, req, webRequest, realm, subject, roles, Integer.valueOf("403"));
  
              throw new EJBAccessDeniedException(TraceNLS.getFormattedMessage(this.getClass(),
                                                                              TraceConstants.MESSAGE_BUNDLE,
                                                                              "EJB_AUTHZ_EXCLUDED",
                                                                              new Object[] { authzUserName, methodName, applicationName },
                                                                              "CWWKS9402A: Authorization failed for user {0} while invoking {1} on {2} because the method is explicitly excluded."));
          }
  
          //return immediately when permitAll is set
          if (methodMetaData.isPermitAll()) {
              if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled()) {
                  Tr.debug(tc, "Authorization granted for " + methodName + " on " + applicationName + " because permitAll is set.");
              }
              ejbAuditHashMap.put(AuditEvent.REASON_TYPE, AuditEvent.REASON_TYPE_EJB_PERMITALL);
              AuditAuthenticationResult auditAuthResult = new AuditAuthenticationResult(AuditAuthResult.SUCCESS, authzUserName, AuditEvent.CRED_TYPE_BASIC, null, AuditEvent.OUTCOME_SUCCESS);
              Audit.audit(Audit.EventID.SECURITY_AUTHZ_04, auditAuthResult, ejbAuditHashMap, req, webRequest, realm, subject, roles, Integer.valueOf("200"));
  
              return;
          }
  
          if (roles == null || roles.isEmpty()) {
              if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled()) {
                  Tr.debug(tc, "Authorization granted for " + methodName + " on " + applicationName + " because no roles are required.");
              }
              ejbAuditHashMap.put(AuditEvent.REASON_TYPE, AuditEvent.REASON_TYPE_EJB_NO_ROLES);
              AuditAuthenticationResult auditAuthResult = new AuditAuthenticationResult(AuditAuthResult.SUCCESS, authzUserName, AuditEvent.CRED_TYPE_BASIC, null, AuditEvent.OUTCOME_SUCCESS);
              Audit.audit(Audit.EventID.SECURITY_AUTHZ_04, auditAuthResult, ejbAuditHashMap, req, webRequest, realm, subject, null, Integer.valueOf("200"));
  
              return;
          }
          SecurityService securityService = securityServiceRef.getService();
          AuthorizationService authzService = securityService.getAuthorizationService();
  
          if (authzService == null) {
              // If we can not get the authorization service, fail securely
              ejbAuditHashMap.put(AuditEvent.REASON_TYPE, AuditEvent.REASON_TYPE_EJB_NO_AUTHZ_SERVICE);
              AuditAuthenticationResult auditAuthResult = new AuditAuthenticationResult(AuditAuthResult.FAILURE, authzUserName, AuditEvent.CRED_TYPE_BASIC, null, AuditEvent.OUTCOME_FAILURE);
              Audit.audit(Audit.EventID.SECURITY_AUTHZ_04, auditAuthResult, ejbAuditHashMap, req, webRequest, realm, subject, roles, Integer.valueOf("403"));
  
              Tr.error(tc, "EJB_AUTHZ_SERVICE_NOTFOUND", authzUserName, methodName, applicationName);
              throw new EJBAccessDeniedException(TraceNLS.getFormattedMessage(this.getClass(),
                                                                              TraceConstants.MESSAGE_BUNDLE,
                                                                              "EJB_AUTHZ_SERVICE_NOTFOUND",
                                                                              new Object[] { authzUserName, methodName, applicationName },
                                                                              "CWWKS9403E: The authorization service could not be found. As a result, the user is not authorized."));
          } else {
              if (!authzService.isAuthorized(applicationName, roles, subject)) {
                  ejbAuditHashMap.put(AuditEvent.REASON_TYPE, AuditEvent.EJB);
                  AuditAuthenticationResult auditAuthResult = new AuditAuthenticationResult(AuditAuthResult.FAILURE, authzUserName, AuditEvent.CRED_TYPE_BASIC, null, AuditEvent.OUTCOME_FAILURE);
                  Audit.audit(Audit.EventID.SECURITY_AUTHZ_04, auditAuthResult, ejbAuditHashMap, req, webRequest, realm, subject, roles, Integer.valueOf("403"));
  
                  Tr.audit(tc, "EJB_AUTHZ_FAILED", authzUserName, methodName, applicationName, roles);
                  throw new EJBAccessDeniedException(TraceNLS.getFormattedMessage(this.getClass(),
                                                                                  TraceConstants.MESSAGE_BUNDLE,
                                                                                  "EJB_AUTHZ_FAILED",
                                                                                  new Object[] { authzUserName, methodName, applicationName,
                                                                                                 roles },
                                                                                  "CWWKS9400A: Authorization failed. The user is not granted access to any of the required roles."));
              } else {
                  ejbAuditHashMap.put(AuditEvent.REASON_TYPE, AuditEvent.EJB);
                  AuditAuthenticationResult auditAuthResult = new AuditAuthenticationResult(AuditAuthResult.SUCCESS, authzUserName, AuditEvent.CRED_TYPE_BASIC, null, AuditEvent.OUTCOME_SUCCESS);
                  Audit.audit(Audit.EventID.SECURITY_AUTHZ_04, auditAuthResult, ejbAuditHashMap, req, webRequest, realm, subject, roles, Integer.valueOf("200"));
              }
          }
      }