public boolean isAllowed(String contextPath, String uri, String method,
			Authentication authentication) {
		Assert.notNull(uri, "uri parameter is required");

		FilterInvocation fi = new FilterInvocation(contextPath, uri, method);
		Collection<ConfigAttribute> attrs = securityInterceptor
				.obtainSecurityMetadataSource().getAttributes(fi);

		if (attrs == null) {
			if (securityInterceptor.isRejectPublicInvocations()) {
				return false;
			}

			return true;
		}

		if (authentication == null) {
			return false;
		}

		try {
			securityInterceptor.getAccessDecisionManager().decide(authentication, fi,
					attrs);
		}
		catch (AccessDeniedException unauthorized) {
			if (logger.isDebugEnabled()) {
				logger.debug(fi.toString() + " denied for " + authentication.toString(),
						unauthorized);
			}

			return false;
		}

		return true;
	}