AclEntryVoter

Class Overview

Given a domain object instance passed as a method argument, ensures the principal has appropriate permission as indicated by the AclService.

The AclService is used to retrieve the access control list (ACL) permissions associated with a domain object instance for the current Authentication object.

The voter will vote if any getAttribute() matches the #processConfigAttribute. The provider will then locate the first method argument of type #processDomainObjectClass. Assuming that method argument is non-null, the provider will then lookup the ACLs from the AclManager and ensure the principal is isGranted(List, List, boolean) when presenting the #requirePermission array to that method.

If the method argument is null, the voter will abstain from voting. If the method argument could not be found, an AuthorizationServiceException will be thrown.

In practical terms users will typically setup a number of AclEntryVoters. Each will have a different processDomainObjectClass, #processConfigAttribute and #requirePermission combination. For example, a small application might employ the following instances of AclEntryVoter:

• Process domain object class BankAccount, configuration attribute VOTE_ACL_BANK_ACCONT_READ, require permission BasePermission.READ
• Process domain object class BankAccount, configuration attribute VOTE_ACL_BANK_ACCOUNT_WRITE, require permission list BasePermission.WRITE and BasePermission.CREATE (allowing the principal to have either of these two permissions)
• Process domain object class Customer, configuration attribute VOTE_ACL_CUSTOMER_READ, require permission BasePermission.READ
• Process domain object class Customer, configuration attribute VOTE_ACL_CUSTOMER_WRITE, require permission list BasePermission.WRITE and BasePermission.CREATE

Alternatively, you could have used a common superclass or interface for the #processDomainObjectClass if both BankAccount and Customer had common parents.

If the principal does not have sufficient permissions, the voter will vote to deny access.

All comparisons and prefixes are case sensitive.

Summary

[Expand] Inherited Constants
From interface org.springframework.security.access.AccessDecisionVoter int ACCESS_ABSTAIN int ACCESS_DENIED int ACCESS_GRANTED

Public Constructors
	AclEntryVoter(AclService aclService, String processConfigAttribute, Permission[] requirePermission)

Public Methods
void	setInternalMethod(String internalMethod)
void	setObjectIdentityRetrievalStrategy(ObjectIdentityRetrievalStrategy objectIdentityRetrievalStrategy)
void	setSidRetrievalStrategy(SidRetrievalStrategy sidRetrievalStrategy)
boolean	supports(ConfigAttribute attribute)
int	vote(Authentication authentication, MethodInvocation object, Collection<ConfigAttribute> attributes)

Protected Methods
String	getInternalMethod() Optionally specifies a method of the domain object that will be used to obtain a contained domain object.
String	getProcessConfigAttribute()

[Expand] Inherited Methods
From class org.springframework.security.access.vote.AbstractAclVoter Object getDomainObjectInstance(MethodInvocation invocation) Class<?> getProcessDomainObjectClass() void setProcessDomainObjectClass(Class<?> processDomainObjectClass) boolean supports(Class<?> clazz) This implementation supports only MethodSecurityInterceptor, because it queries the presented MethodInvocation.
From class java.lang.Object Object clone() boolean equals(Object arg0) void finalize() final Class<?> getClass() int hashCode() final void notify() final void notifyAll() String toString() final void wait() final void wait(long arg0, int arg1) final void wait(long arg0)
From interface org.springframework.security.access.AccessDecisionVoter abstract boolean supports(Class<?> clazz) Indicates whether the AccessDecisionVoter implementation is able to provide access control votes for the indicated secured object type. abstract boolean supports(ConfigAttribute attribute) Indicates whether this AccessDecisionVoter is able to vote on the passed ConfigAttribute. abstract int vote(Authentication authentication, S object, Collection<ConfigAttribute> attributes) Indicates whether or not access is granted.