Spring Security SEC-1159: Object context dependant roles in ACLs

Grzegorz Borkowski (Migrated from SEC-1159) said:

I'm trying to figure out how to add concept of "context-dependant roles", i.e. roles granted to the user only for specific domain objects. Currently you can link Access Control Entry from ACL to either specific user, or the role. But role is global here: if you have a role PROJECT_MANAGER you are the manager for all projects in the system. This is not very practical. I want to be able to say: user A is a manager for project X, but not for project Y. Being the manager for project, means that you are granted many privileges for this project: read, update, delete, add task, etc. So if user A has MANAGER role on project X, he is granted all the permissions on this project. Now suppose there can be many managers for this project. Repeating all the permission records for every manager is is pointless: I would prefer to just assign these permissions to the role MANAGER (like with GranthedAuthoritySid) but assign the role to the user not globally, but in the context of specific instance of domain object.

After thinking about it, I see the following solution for this. 1.JdbcAclService uses 4 tables in database. We'll need the 5th one, called say "ACL_ROLE_TO_PRINCIPAL". It has four columns: first is autoincrement ID, second is a foreign key to ACL_OBJECT_IDENTITY table pointing at "context object", third is a foreign key to ACL_SID tables pointing at user principal (row with principal flag set to true), i.e. to the user, and forth is again foreign key to ACL_SID pointing at role name (granted authority), ie. at row with principal flag set to false. Now if you want to say that users A,B and C are managers in project X, you create three rows in this table with following values: 1, X-ref, A-ref, MANAGER-ref 2, X-ref, B-ref, MANAGER-ref 3, X-ref, C-ref, MANAGER-ref 1. We create new interface, similar to SidRetrievalStrategyImpl, say called ObjectSpecificGrantedAuthoritiesRetrievalStrategy or so, with one method: public Sid[] getObjectSpecificSids(Sid[] globalSids, ObjectIdentity objectIdentity) Implementation of this interface will use the table mentioned above to retrieve Sids based on it. For example, for user A the "global" sid array passed to this method could contain only one element: PrinciapalSid ("A"), and the method will return the Sid array with one elment: GrantedAuthoritySid ("MANAGER").

3.The AclEntryImplementation must be refactored: the property with ObjectSpecificGrantedAuthoritiesRetrievalStrategy must be added (getter and setter). Then in the vote() method implementation (main method of the voter), after these lines (based on 2.0.4 source): // Obtain the OID applicable to the domain object ObjectIdentity objectIdentity = objectIdentityRetrievalStrategy.getObjectIdentity(domainObject);

        // Obtain the SIDs applicable to the principal
        Sid[] sids = sidRetrievalStrategy.getSids(authentication);

we would add the lines: if (objectSpecificAuthoritiesRetrievalStrategy != null) { Sid[] objectSpecificSids = objectSpecificAuthoritiesRetrievalStrategy.getObjectSpecificSids(sids, ObjectIdentity objectIdentity); sids = ...//merge sids array with objectSpecicSids }

The overall result seems very powerful and not much complicated, and would significantly enhance the ACL package capabilities.