I have a filter definition similar to:
/some/url/** = someFilter, anotherFilter, perms["perm1", "perm2"]
The above does not work – the parser concatenates perm1 and perm2 into one permission, and therefore denies the request.
The "fix" is to add a space before the trailing "]" i.e.:
/some/url/** = someFilter, anotherFilter, perms["perm1", "perm2" ]
This then works fine. Ouch!
As an aside, the trace level logging logs all sorts of stuff to the logs, but fails to log anything from the perms filter explaining why the request was being denied. This is weird, to say the least.