@Override
    protected void doApply(ApiRequest request, IPolicyContext context, SoapAuthorizationConfig config,
            IPolicyChain<ApiRequest> chain) {
        Set<String> userRoles = context.getAttribute(AUTHENTICATED_USER_ROLES, (HashSet<String>) null);
        String action = request.getHeaders().get(HEADER_SOAP_ACTION);

        // Check if action are defined then fail with configuration error.
        if (action == null || StringUtils.isBlank(action)) { // "SOAPAction header is not defined."
        	String msg = Messages.getString("SoapAuthorizationPolicy.SOAPActionHeaderNotDefined"); //$NON-NLS-1$

        	PolicyFailure failure = context.getComponent(IPolicyFailureFactoryComponent.class).createFailure(
                    PolicyFailureType.Other, SOAP_ACTION_NOTDEFINED, msg );
        	chain.doFailure(failure);
        	return;
        }

        // If no roles are set in the context - then fail with a configuration error
        if (userRoles == null) {
            String msg = Messages.getString("SoapAuthorizationPolicy.MissingRoles"); //$NON-NLS-1$
            PolicyFailure failure = context.getComponent(IPolicyFailureFactoryComponent.class).createFailure(
                    PolicyFailureType.Other, PolicyFailureCodes.CONFIGURATION_ERROR, msg);
            chain.doFailure(failure);
            return;
        }

        if (isAuthorized(config, action, userRoles)) {
            chain.doApply(request);
        } else {
            String msg = Messages.getString("SoapAuthorizationPolicy.Unauthorized"); //$NON-NLS-1$
            PolicyFailure failure = context.getComponent(IPolicyFailureFactoryComponent.class).createFailure(
                    PolicyFailureType.Authorization, PolicyFailureCodes.USER_NOT_AUTHORIZED, msg);
            chain.doFailure(failure);
        }
    }
@see io.apiman.gateway.engine.policies.AbstractMappedPolicy#doApply(io.apiman.gateway.engine.beans.ApiRequest, io.apiman.gateway.engine.policy.IPolicyContext, java.lang.Object, io.apiman.gateway.engine.policy.IPolicyChain)
plugins/soap-authorization-policy/src/main/java/io/apiman/plugins/soap_authorization_policy/SoapAuthorizationPolicy.java