ACL sample missing, still relevant?

[Yberion]

Hello,

Is ACL still relevant nowadays ?

I'm asking this question because there is a reference to "Contacts" and "Document Management System" samples in the doc regarding ACL, but I can't find those samples.

ACL is quite complex and it's hard to use this system without a proper up-to-date sample, so is it still a good system to use if we want to restrict access to a specific object ? (Something like ownership)

Should I use something else ?

Thanks for your time.

[marcusdacoregio]

Hi @Yberion, thanks for bringing this up.

The ACL module is mostly being maintained by the community right now.
The reason for that is because Spring Security's ACL implementation allows users to determine if access is allowed after the results come back from the database. This works when there is a small number of results, but breaks down when paging is necessary. So what the team recommends is that you go for the Spring Data Integration to query your results. We also have a ticket in Spring Security to automatically update the query.

However, you can still find the ACL samples on this older branch of Spring Security's repository.

I'm closing this but feel free to continue the discussion.

[Yberion]

So what the team recommends is that you go for the Spring Data Integration to query your results.

So you suggest that the "ownership" of an object should be checked with a Query ? (Something like this ? https://docs.spring.io/spring-security/site/docs/current/reference/html5/#data-query)

Do you mind providing a very little sample of such system ?

I'd like to get the best practice when I'm coding.

What if I have 2 ROLES, like ROLE_1 and ROLE_2.

• ROLE_1 can WRITE_ARTICLE, EDIT_ARTICLE and READ_ARTICLE
• ROLE_2 can READ_ARTICLE

But, people with ROLE_2 are allowed to read an article only if someone with ROLE_1 allowed it.

How would you allow that with a Query ?

[marcusdacoregio]

I think in your scenario SpEL would work:

@Service
public class ArticleSecurityService {
    public boolean canReadArticle(Long articleId) {
        ... apply as many checks as you want to see if the current user can read the article
    }
}

@Service
public class ArticleService {
    @PreAuthorize("@articleSecurityService.canReadArticle(#articleId)")
    public Article getArticle(Long articleId) {
        ... returns the article
    }
}

This way you can improve your permissions more easily.
Does it makes sense for you or do you think ACLs would fit more in your scenario?

[marcusdacoregio]

Just a heads up that I've added those two ACL samples to be included in this repository. This is the ticket for it #22