public PutAllOperationContext putAllAuthorize(String regionName, Map map, Object callbackArg)
      throws NotAuthorizedException {
    PutAllOperationContext putAllContext = new PutAllOperationContext(map);
    putAllContext.setCallbackArg(callbackArg);
    if (!authzCallback.authorizeOperation(regionName, putAllContext)) {
      final String errStr =
          String.format("Not authorized to perform PUTALL operation on region [%s]",
              regionName);
      if (logger.warningEnabled()) {
        logger.warning(String.format("%s : %s", this, errStr));
      }
      if (isPrincipalSerializable) {
        throw new NotAuthorizedException(errStr, principal);
      } else {
        throw new NotAuthorizedException(errStr);
      }
    } else {
      if (logger.finestEnabled()) {
        logger.finest(
            this + ": Authorized to perform PUTALL operation on region [" + regionName + ']');
      }

      // now since we've authorized to run PUTALL, we also need to verify all the
      // <key,value> are authorized to run PUT
      /*
       * According to Jags and Suds, we will not auth PUT for PUTALL for now We will only do auth
       * once for each operation, i.e. PUTALL only Collection entries = map.entrySet(); Iterator
       * iterator = entries.iterator(); Map.Entry mapEntry = null; while (iterator.hasNext()) {
       * mapEntry = (Map.Entry)iterator.next(); String currkey = (String)mapEntry.getKey(); Object
       * value = mapEntry.getValue(); boolean isObject = true; if (value instanceof byte[]) {
       * isObject = false; } byte[] serializedValue =
       * ((CachedDeserializable)value).getSerializedValue();
       *
       * PutOperationContext putContext = new PutOperationContext(currkey, serializedValue,
       * isObject, PutOperationContext.UNKNOWN, false); putContext.setCallbackArg(null); if
       * (!this.authzCallback.authorizeOperation(regionName, putContext)) { String errStr =
       * "Not authorized to perform PUT operation on region [" + regionName + ']' +
       * " for key "+currkey +". PUTALL is not authorized either."; if
       * (this.logger.warningEnabled()) { this.logger.warning(toString() + ": " + errStr); } if
       * (this.isPrincipalSerializable) { throw new NotAuthorizedException(errStr, this.principal);
       * } else { throw new NotAuthorizedException(errStr); } } else { if
       * (this.logger.finestEnabled()) { this.logger.finest(toString() +
       * ": PUT is authorized in PUTALL for "+currkey+" isObject("+isObject+") on region [" +
       * regionName + ']'); } } } // while iterating map
       */
    }
    return putAllContext;
  }
This class implements authorization calls for various operations. It provides methods to invoke
authorization callback ({@link AccessControl#authorizeOperation}) before the actual operation to
check for authorization (pre-processing) that may modify the arguments to the operations. The
data being passed for the operation is encapsulated in a {@link OperationContext} object that can
be modified by the pre-processing authorization callbacks.

@since GemFire 5.5
geode-core/src/main/java/org/apache/geode/internal/security/AuthorizeRequest.java