server/src/main/java/com/orientechnologies/orient/server/security/authenticator/OServerConfigAuthenticator.java
public boolean isAuthorized(final String username, final String resource) {
    if (username == null || resource == null)
      return false;

    if (getServerConfig() != null) {
      // getUser() will throw an IllegalArgumentException if username is null or empty.
      // However, a null or empty username is possible with some security implementations.
      if (!username.isEmpty()) {
        OServerUserConfiguration userCfg = getServerConfig().getUser(username);

        if (userCfg != null) {
          // Total Access
          if (userCfg.resources.equals("*"))
            return true;

          String[] resourceParts = userCfg.resources.split(",");

          for (String r : resourceParts) {
            if (r.equalsIgnoreCase(resource))
              return true;
          }
        }
      }
    } else {
      OLogManager.instance().error(this, "OServerConfigAuthenticator.isAuthorized() ServerConfig is null", null);
    }

    return false;
  }
public boolean isAuthorized(final String username, final String resource) {
    if (username == null || resource == null)
      return false;

    if (getServerConfig() != null) {
      // getUser() will throw an IllegalArgumentException if username is null or empty.
      // However, a null or empty username is possible with some security implementations.
      if (!username.isEmpty()) {
        OServerUserConfiguration userCfg = getServerConfig().getUser(username);

        if (userCfg != null) {
          // Total Access
          if (userCfg.resources.equals("*"))
            return true;

          String[] resourceParts = userCfg.resources.split(",");

          for (String r : resourceParts) {
            if (r.equalsIgnoreCase(resource))
              return true;
          }
        }
      }
    } else {
      OLogManager.instance().error(this, "OServerConfigAuthenticator.isAuthorized() ServerConfig is null", null);
    }

    return false;
  }
If not supported by the authenticator, return false.