private boolean isAuthorized(SoapAuthorizationConfig config, String action, Set<String> userRoles) {
        // If multiMatch is set to 'any', then start out with authorized = false, and we need to
        // find at least one match to turn authorized to true.  If it's set to "all" (the default)
        // then start out authorized, and it requires *every* matching rule to pass or else it'll
        // switch to false.
        boolean authorized = true;
        if (config.getMultiMatch() == MultipleMatchType.any) {
            authorized = false;
        }
        boolean matchFound = false;
        for (SoapAuthorizationRule soapAuthorizationRule : config.getRules()) {
            boolean actionMatches = "*".equals(soapAuthorizationRule.getAction()) || action.equalsIgnoreCase(soapAuthorizationRule.getAction()); //$NON-NLS-1$
            if (actionMatches) {
                // the action and resource matched the rule - so enforce the role here!
                boolean userHasRole = userRoles.contains(soapAuthorizationRule.getRole());
                matchFound = true;

                // If the multiMatch setting is "at least one matching rule" then do a logical
                // OR operation.  If it's set to "all matching rules" then do a logical AND.
                if (config.getMultiMatch() == MultipleMatchType.any) {
                    authorized = authorized || userHasRole;
                } else {
                    authorized = authorized && userHasRole;
                }
            }
        }

        // If no authorization rules matched the request, what do we do?
        if (!matchFound) {
            if (config.getRequestUnmatched() == UnmatchedRequestType.pass) {
                authorized = true;
            } else {
                authorized = false;
            }
        }

        return authorized;
    }
Checks the action and resource against the requirements configured for the
policy.  Returns true if the user has all of the required roles (multiple
roles may be required depending on configuration).

Note that if the configuration does not include any

@param config
@param action
@param resource
@param userRoles
plugins/soap-authorization-policy/src/main/java/io/apiman/plugins/soap_authorization_policy/SoapAuthorizationPolicy.java