Question: To prevent a user role from performing an action. 

1. Example 1: The role "administrator" 
is the only role allowed to perform 
destroy action.
2. Example 2: Any role different from "guest" can perform CREATE action.

In a real case, I have this:

```
public String delete() {
 if(FacesContext.getCurrentInstance().getExternalContext().isUserInRole("administrator"){
   //.....the action to perform
 }
 return "Denied";
}

```

I wish I could use the annotation `@RolesAllowed()` of EJB yet I am not using EJB but ManagedBeans.
So the question is: Is there any way to use many roles at the same time? Some workaround!
Example: If an action must be allowed to 3 roles (administrator, moderator, manager). I am obliged to do :

```
if (FacesContext.getCurrentInstance().getExternalContext().isUserInRole("administrator")
    || FacesContext.getCurrentInstance().getExternalContext().isUserInRole("manager") 
    || .....) {
  //....
}

```

And it is a pain to reproduce on all the methods. Something like hundreds of methods :(

Answer: 
You can shorten that by moving the logic to an utility method:

```
public class AuthorizationUtils {
    public static boolean isUserInRoles(String[] roles) {
        for (String role : roles) {
            if (FacesContext........isUserInRole(role)) {
                return true;
            }
        }

        return false;
    }
}

```

And then invoke it with:

```
if (AuthorizationUtils.isUserInRoles(new String[] {"administrator", "moderator"})) {
    ..
}

```

If you are using CDI, you can make an interceptor that handles the `@RolesAllowed` annotation
@Mediterran81: So basically you are looking for bean-method based authorization solution...how are you instantiating your managed beans? You may like to introduce a simple XML format:-

```
<bean class="">
 <method name="">
  <role> xyz</role>
 </method>
</bean>

```

Have this XML read by utility class and then only thing you would need to do is to call Utility's static method to determine if method is allowed to execute.