code: public boolean doAssert(AdRoleAssertion roleAssertion) throws NamingException {
          boolean result = false;
  
          if (roleAssertion.getPrincipal() == null) {
              LOG.warn("DACLAssertor.run, unable to run against a NULL principal specified in AdRoleAssertion");
              return result;
          }
  
          if (dacl == null) {
              getDACL();
          }
  
          this.unsatisfiedAssertions = findUnsatisfiedAssertions(roleAssertion);
          result = this.unsatisfiedAssertions.isEmpty() ? true : false;
          LOG.info("doAssert, result: {}", result);
          return result;
      }
docs: Compares the object DACL located by the searchFilter against the specified {@code AdRoleAssertion}, and
  determines whether
  that assertion's principal is granted all the rights which the assertion contains.<br>
  <br>
  When comparing ACEs of the DACL, only those of {@code AceType.ACCESS_ALLOWED_ACE_TYPE} or
  {@code AceType.ACCESS_ALLOWED_OBJECT_ACE_TYPE} will be considered for satisfying an {@code AceAssertion} of the
  roleAssertion.<br>
  <br>
  Once completed, any unsatisfied assertions can be obtained by calling {@linkplain getUnsatisfiedAssertions}.
  
  @param roleAssertion
  the AdRoleAssertion
  @return true if the DACL fulfills the claims of the roleAssertion, false otherwise.
  @throws CommunicationException
  if the context for searching the DACL is invalid or the domain cannot be reached
  @throws NameNotFoundException
  if the DACL search fails
  @throws NamingException
  if extracting the DACL fails or another JNDI issue occurs
  @throws SizeLimitExceededException
  if more than one AD object found during DACL search