Probably it was fixed in 3.1 At least I got both authorize and accesscontrollist TAGs worrking with custom PermissionEvaluator:



<http entry-point-ref="casEntryPoint" use-expressions="true" >...