[QUESTION] How do ACL and domain level security work?

[@krzysztofzabolotny4802]

I got an internship and that's my second taks, to implement ACL. God bless you for that.

[@baravi2005]

Super helpful video on Domain object security Laurentiu...also loved your "Spring Security in Action" book!!

[@panagiotiskapralos7021]

Thank you, excellent explanation

[@laurspilca]

Thank you!

[@malg5547]

Great explanation, thanks for your time

[@Runnable19]

Hello Laur, thanks for the amazing work and for remaining yourself through all these years. I have a question regarding implementing ABAC with spring security, what is the best approach or what libraries exist to make this easier, overall how much would you recommend this over ACL ?

[@laurspilca]

Thank you. To be honest I prefer simplicity and never really liked ACLs. But if you need high customization that's I think the only real choice you have with Spring Security.

[@eq716]

thanks a lot! great explanation!

[@wkamdem80]

for performance, it's possible to add indexes on some columns of the acl_entry table? great video, thanks!

[@laurspilca]

Hi William. Definitely. It is even recommended. In my tutorials I avoid doing this just to focus on the Spring Security part. But in a practical scenario you should do this. Thank you for the question :)

[@DavitJibuti]

Thanks for this video! What is the best way to manage "acl" tables? example when registrering new user, you have to add user in "users" table plus add permissions in to "acl" tables for the concrate user (user can modify its details, or maybe user can remove himself, but should not have permission to see or delete other user), does the Spring Security ACL has standart way(Objects/methods) of implementing it or should I implement it mannually?

[@laurspilca]

Hi. Thanks for the question. It really depends on the case which is the best way. All your suggestion could be a good choice for registering the users depending on the scenario :)

[@DavitJibuti]

@@laurspilca I desided to use MutableAclServie to manage permissions but, i have some strange case with mutableAclService.createAcl(oi), its adds anonymousUser in to acl_object_identity table in every case, do you have some experiance in it? maybe its not the good place to discuss it but, if you know please let me know. I have the question on stackOverflow also with name "Spring Security ACL allways sets anonymousUser as Owner "

[@laurspilca]

@@DavitJibuti Hey. No, I'm not sure I simply know what the problem is here. I would have to investigate it myself. I usually debug on the framework's code when I get into such a situation.

[@Istheresomeoneelseornot15]

thank you for thorough explanation!

[@eswarjoan]

I don't see this PostFilter is working by username. Because where are you passing the username to validate/filter?. This is simply returning WRITE access objects. If you make more acl entries for one more user, this is filter is failed and we are getting all products irrespective of any users.

[@laurspilca]

True. But I don't think I had any intention for that post filter to show only the user's products. That post filter clearly only checks on the authority. If you want to check on the user, you can always take the principal from the security context and validate that the product belongs to that user.

[@Boria7777]

very useful information. thank!!!

[@jameswu800]

PostFilter("hasPermission(filterObject, 'WRITE')") //Is filterObject defined somewhere? Is it a fixed name? Or any name would work?

[@laurspilca]

Hi. filterObject is a fixed name that always represents the object inside the array or collection the method gets as a parameter.

[@MarwanAmeen89]

What happened when we post filter with pagination ? Let's say if the first page of the returned results user has no permission to access them how to move to the next page?

[@laurspilca]

Hi Marawan, Great question. It's actually not a problem because findAll() will only return now the allowed records. Observe that @PostFilter only filters the data, it doesn't throw any exception. For the client is completely transparent. They will see on the next page the records they have access to - if any - if not, there will be no next page. I hope this answers your question :) Thanks again!

[@MarwanAmeen89]

Hi @@laurspilca, thanks for replying out, I am not taking about findall() where pagination happened at front end, I am talking about the findAll(pageabl) with the spring jpa, because let's say my page size is 50 but I am only allowed to view 10 records from the result , my endpoints will return only 10, rather than 50 what if the 50 items are not in permission? I haven't tried that , I am still new the ACL .

[@laurspilca]

@@MarwanAmeen89 Ah. I think I understand your question now. It's actually about @PostFilter, not about ACL. But the rule I know is that @PostFilter can only be used on a Collection or an array. The method you refer to returns a different object which is neither Collection, nor array: Pageable. So applying @PostFilter on it will fail with an exception. But, what can you do is actually move the @PostFilter one more layer to the left, in the service. And then you can filter on the collection returned by the getContent() method of the Pageable object.

[@laurspilca]

@@MarwanAmeen89 Hello again. I have tried to share my opinion with this video. I hope it helps :)_ kzbin.info/www/bejne/q5SWlYqkf7h_Y5o

[@syednoorullahshah9194]

does spring acl scale well in enterprise applications ? it looks complicated

[@laurspilca]

Not really. I personally avoid it.

[@syednoorullahshah9194]

so what are the alternates. I have a requirement for it

[@laurspilca]

@@syednoorullahshah9194 It depends on the requirement. I can't tell you what the best solution is for a problem whose statement I don't know.

[@baravi2005]

I tried to make it work with in memory H2 database, but was getting some circular reference errors :(

[@temptrue3322]

Maybe a bit too late, but try to keep GlobalMethodSecurityConfiguration in seperate configuration file and keep acl related configurations in another file

[@ramanjaneyas8589]

HI Laurentitu i want know what will be the procedure if we want to perform CRUD operation for the domain object except reading. i tried deleting a domain object by implementing a controller but its throwing forbidden error.. @DeleteMapping("/product/{id}") @PreAuthorize("hasPermission(#id, 'delete')") public void deleteProductById(@PathVariable("id") int id) { productService.deleteProductById(id); }

[@laurspilca]

Hello. I'll create later a lesson in the Spring Security stream about global method security. I hope that one will clarify for you how these annotations work. Stay tuned.

[@ramanjaneyas8589]

@@laurspilca okay

[@mechtarin]

49:44 AWESOME

[@nourti]

great work appreciated