server/src/main/java/com/orientechnologies/orient/server/security/authenticator/ODefaultPasswordAuthenticator.java
public boolean isAuthorized(final String username, final String resource) {
    if (username == null || resource == null)
      return false;

    OServerUserConfiguration userCfg = getUser(username);

    if (userCfg != null) {
      // Total Access
      if (userCfg.resources.equals("*"))
        return true;

      String[] resourceParts = userCfg.resources.split(",");

      for (String r : resourceParts) {
        if (r.equalsIgnoreCase(resource))
          return true;
      }
    }

    return false;
  }
public boolean isAuthorized(final String username, final String resource) {
    if (username == null || resource == null)
      return false;

    OServerUserConfiguration userCfg = getUser(username);

    if (userCfg != null) {
      // Total Access
      if (userCfg.resources.equals("*"))
        return true;

      String[] resourceParts = userCfg.resources.split(",");

      for (String r : resourceParts) {
        if (r.equalsIgnoreCase(resource))
          return true;
      }
    }

    return false;
  }
If not supported by the authenticator, return false.