Summary

In this chapter, we focused on security based on ACLs and the specific details of how this type of security is implemented by the Spring ACL module.

We reviewed the basic concept of ACLs, and many reasons why they can be very effective solutions to authorization. Also, we learned about the key concepts related to the Spring ACL implementation, including ACEs, SIDs, and object identity. We examined the database schema and logical design required to support a hierarchical ACL system. We configured all the required Spring beans to enable the Spring ACL module and enhanced one of the service interfaces to use annotated method authorization.

We then tied the existing users in our database, and business objects used by the site itself, into a sample set of ACE declarations and supporting data. We reviewed the concepts around Spring ACL permission handling. We expanded our knowledge of the Spring Security Thymeleaf tag library and SpEL (for method security) to utilize ACL checks...