Method authorization

[phe]

ACL is overkill for my application because my services retrieve all objects from another Spring application. Still i would like that users can´t see data that does not belong to them. As i understand this is possible

@PreAutorize(#username == principal.username)
public String viewProfile( String username) {
 retutn "";
}

would like to something like

@PreAutorize(#company == principal.company)
public String viewProfile( Company company) {
  retutn "";
}

The principal does not have a company attribute but hope you understand what I am trying to do.
What is the best way of doing this?

Thanks

[arai]

you can get some idea from http://stackoverflow.com/questions/9...on-not-working