@SuppressWarnings({"unchecked"})
    public boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) throws IOException {

        Subject subject = getSubject(request, response);
        String[] rolesArray = (String[]) mappedValue;

        if (rolesArray == null || rolesArray.length == 0) {
            //no roles specified, so nothing to check - allow access.
            return true;
        }

        Set<String> roles = CollectionUtils.asSet(rolesArray);
        return subject.hasAllRoles(roles);
    }
Filter that allows access if the current user has the roles specified by the mapped value, or denies access
if the user does not have all of the roles specified.

@since 0.9
web/src/main/java/org/apache/shiro/web/filter/authz/RolesAuthorizationFilter.java