@Override
    public boolean canSubscribe(Node node, JID owner, JID subscriber) {
        // Let node owners and sysadmins always subscribe to the node
        if (node.isAdmin(owner)) {
            return true;
        }
        for (JID nodeOwner : node.getOwners()) {
            if (nodeOwner.equals(owner)) {
                return true;
            }
        }
        // Check that the subscriber is a local user
        XMPPServer server = XMPPServer.getInstance();
        if (server.isLocal(owner)) {
            GroupManager gMgr = GroupManager.getInstance();
            Collection<String> nodeGroups = node.getRosterGroupsAllowed();
            for (String groupName : nodeGroups) {
                try {
                    Group group = gMgr.getGroup(groupName);
                    // access allowed if the node group is visible to the subscriber
                    if (server.getRosterManager().isGroupVisible(group, owner)) {
                        return true;
                    }
                } catch (GroupNotFoundException gnfe){ 
                    // ignore
                }
            }
        }
        else {
            // Subscriber is a remote user. This should never happen.
            Log.warn("Node with access model Roster has a remote user as subscriber: {}", node.getUniqueIdentifier());
        }
        return false;
    }
Anyone in the specified roster group(s) may subscribe and retrieve items.

@author Matt Tucker
xmppserver/src/main/java/org/jivesoftware/openfire/pubsub/models/RosterAccess.java