How to get a list of domain objects for which a user has permissions for Spring ACL security?

Question

I'm just starting to use Spring Security ACL. I want to get a list of domain objects for which the user has (any) permissions for.

For example, a system has 1000 “buildings”, a user can have access to any number of these buildings. When a user logs in, I want to present them with a list of the building for which they have permissions.

Something in the lines myAclService.getObjectsForUser ( [e-mail] , Building.class)

I am starting to think that ACLs do not work in this direction, but this should be a common task, so at least there should be an example of how to achieve this together with ACLs without duplicating data.

Any thoughts are welcome, thanks!

Answer 1

I believe that you are correct in what is provided in Spring Security re. ACLs are more from the perspective of an object than from a topic (main).

You can check the SQL code of all AclService with Spring Security, specifically JdbcAclService and JdbcMutableAclService .

Answer 2

Do you want to use @PostFilter annotations

 @PostFilter("hasPermission(filterObject, 'read') or hasPermission(filterObject, 'admin')") public List<Buildings> getAll();