ACLs in Spring Security
Spring Security supports ACL-driven authorization checks against access to individual domain objects by individual users of the secured system. As in the OS filesystem example, it is possible to use the Spring Security ACL components to build logical tree structures of both business objects and groups or principals. The intersection of permissions (inherited or explicit) on both the requestor and the requestee is used to determine allowed access.
It’s quite common for users approaching the ACL capability of Spring Security to be overwhelmed by its complexity, combined with a relative dearth of documentation and examples. This is compounded by the fact that setting up the ACL infrastructure can be quite complicated, with many interdependencies and reliance on bean-based configuration mechanisms, which are quite unlike much of the rest of Spring Security (as you’ll see in a moment when we set up the initial configuration).
The Spring Security...
