help on acegi's ACL. I can't well understand with sample.

[creatxr]

How does it return the owner's recoder?

dianne's Contacts
id Name Email 
4  Karen Sutherland  karen@sutherland.com  Del Admin Permission 
5  Mitchell Howard  mitchell@abcdef.com  
6  Rose Costas  rose@xyz.com  Del 
8  Cindy Smith  cindy@smith.com  


Add 

Logoff (also clears any remember-me cookie)

I try to trace it with codes, buy I didn't find how to do.


from login:

    <bean id="urlMapping" class="org.springframework.web.servlet.handler.SimpleUrlHandlerMapping">
        <property name="mappings">
            <props>
                <prop key="/hello.htm">publicIndexController</prop>
                <prop key="/secure/add.htm">secureAddForm</prop>
                <prop key="/secure/index.htm">secureIndexController</prop>
                <prop key="/secure/del.htm">secureDeleteController</prop>
                <prop key="/secure/adminPermission.htm">adminPermissionController</prop>
                <prop key="/secure/deletePermission.htm">deletePermissionController</prop>
                <prop key="/secure/addPermission.htm">addPermissionForm</prop>
			</props>
        </property>
    </bean>

    <bean id="secureIndexController" class="sample.contact.SecureIndexController">
    	<property name="contactManager"><ref bean="contactManager"/></property>
 	</bean>

    public ModelAndView handleRequest(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        List myContactsList = contactManager.getAll();
        Contact myContacts[];
        if(myContactsList.size() == 0)
            myContacts = null;
        else
            myContacts = (Contact[])(Contact[])myContactsList.toArray(new Contact[0]);
        Map model = new HashMap();
        model.put("contacts", myContacts);
        return new ModelAndView("index", "model", model);
    }

   <bean id="contactManager" class="org.springframework.aop.framework.ProxyFactoryBean">
      <property name="proxyInterfaces"><value>sample.contact.ContactManager</value></property>
      <property name="interceptorNames">
         <list>
            <idref local="transactionInterceptor"/>

            <idref bean="contactManagerSecurity"/>

<!--
I know that 's the bean "contactManagerSecurity " does.

because after I remove it , it shows all 9 recorders.
-->

            <idref local="contactManagerTarget"/>
         </list>
      </property>
   </bean>

  <bean id="contactManagerSecurity" class="net.sf.acegisecurity.intercept.method.aopalliance.MethodSecurityInterceptor">
      <property name="authenticationManager"><ref bean="authenticationManager"/></property>
      <property name="accessDecisionManager"><ref local="businessAccessDecisionManager"/></property>
      <property name="afterInvocationManager"><ref local="afterInvocationManager"/></property>
      <property name="objectDefinitionSource">
         <value>
				sample.contact.ContactManager.create=ROLE_USER
				sample.contact.ContactManager.getAllRecipients=ROLE_USER
				sample.contact.ContactManager.getAll=ROLE_USER,AFTER_ACL_COLLECTION_READ
				sample.contact.ContactManager.getById=ROLE_USER,AFTER_ACL_READ
				sample.contact.ContactManager.delete=ACL_CONTACT_DELETE
				sample.contact.ContactManager.deletePermission=ACL_CONTACT_ADMIN
				sample.contact.ContactManager.addPermission=ACL_CONTACT_ADMIN
         </value>
      </property>

I'm puzzled here. I don't know how it filtes the recorders?

[creatxr]

I decompiled class DataSourcePopulator.

CREATE TABLE CONTACTS(ID INTEGER NOT NULL PRIMARY KEY, CONTACT_NAME VARCHAR_IGNORECASE(50) NOT NULL, EMAIL VARCHAR_IGNORECASE(50) NOT NULL)
INSERT INTO contacts VALUES (1, 'John Smith', 'john@somewhere.com');
INSERT INTO contacts VALUES (2, 'Michael Citizen', 'michael@xyz.com');
INSERT INTO contacts VALUES (3, 'Joe Bloggs', 'joe@demo.com');
INSERT INTO contacts VALUES (4, 'Karen Sutherland', 'karen@sutherland.com');
INSERT INTO contacts VALUES (5, 'Mitchell Howard', 'mitchell@abcdef.com');
INSERT INTO contacts VALUES (6, 'Rose Costas', 'rose@xyz.com');
INSERT INTO contacts VALUES (7, 'Amanda Smith', 'amanda@abcdef.com');
INSERT INTO contacts VALUES (8, 'Cindy Smith', 'cindy@smith.com');
INSERT INTO contacts VALUES (9, 'Jonathan Citizen', 'jonathan@xyz.com');
CREATE TABLE ACL_OBJECT_IDENTITY(ID INTEGER GENERATED BY DEFAULT AS IDENTITY(START WITH 100)  NOT NULL PRIMARY KEY,
OBJECT_IDENTITY VARCHAR_IGNORECASE(250) NOT NULL,PARENT_OBJECT INTEGER,ACL_CLASS VARCHAR_IGNORECASE(250) NOT NULL,
CONSTRAINT UNIQUE_OBJECT_IDENTITY UNIQUE(OBJECT_IDENTITY),CONSTRAINT SYS_FK_3 FOREIGN KEY(PARENT_OBJECT) REFERENCES ACL_OBJECT_IDENTITY(ID))
INSERT INTO acl_object_identity VALUES (1, 'sample.contact.Contact:1', null, 'net.sf.acegisecurity.acl.basic.SimpleAclEntry');
INSERT INTO acl_object_identity VALUES (2, 'sample.contact.Contact:2', null, 'net.sf.acegisecurity.acl.basic.SimpleAclEntry');
INSERT INTO acl_object_identity VALUES (3, 'sample.contact.Contact:3', null, 'net.sf.acegisecurity.acl.basic.SimpleAclEntry');
INSERT INTO acl_object_identity VALUES (4, 'sample.contact.Contact:4', null, 'net.sf.acegisecurity.acl.basic.SimpleAclEntry');
INSERT INTO acl_object_identity VALUES (5, 'sample.contact.Contact:5', null, 'net.sf.acegisecurity.acl.basic.SimpleAclEntry');
INSERT INTO acl_object_identity VALUES (6, 'sample.contact.Contact:6', null, 'net.sf.acegisecurity.acl.basic.SimpleAclEntry');
INSERT INTO acl_object_identity VALUES (7, 'sample.contact.Contact:7', null, 'net.sf.acegisecurity.acl.basic.SimpleAclEntry');
INSERT INTO acl_object_identity VALUES (8, 'sample.contact.Contact:8', null, 'net.sf.acegisecurity.acl.basic.SimpleAclEntry');
INSERT INTO acl_object_identity VALUES (9, 'sample.contact.Contact:9', null, 'net.sf.acegisecurity.acl.basic.SimpleAclEntry');

CREATE TABLE ACL_PERMISSION(ID INTEGER GENERATED BY DEFAULT AS IDENTITY(START WITH 100)  NOT NULL PRIMARY KEY,
ACL_OBJECT_IDENTITY INTEGER NOT NULL,
RECIPIENT VARCHAR_IGNORECASE(100) NOT NULL,
MASK INTEGER NOT NULL,
CONSTRAINT UNIQUE_RECIPIENT UNIQUE(ACL_OBJECT_IDENTITY,RECIPIENT),
CONSTRAINT SYS_FK_7 FOREIGN KEY(ACL_OBJECT_IDENTITY)
REFERENCES ACL_OBJECT_IDENTITY(ID))

INSERT INTO acl_permission VALUES (null, 1, 'marissa', 1);
INSERT INTO acl_permission VALUES (null, 2, 'marissa', 2);
INSERT INTO acl_permission VALUES (null, 3, 'marissa', 22);
INSERT INTO acl_permission VALUES (null, 4, 'marissa', 1);

INSERT INTO acl_permission VALUES (null, 4, 'scott', 2);
INSERT INTO acl_permission VALUES (null, 6, 'scott', 2);
INSERT INTO acl_permission VALUES (null, 7, 'scott', 1);
INSERT INTO acl_permission VALUES (null, 8, 'scott', 2);
INSERT INTO acl_permission VALUES (null, 9, 'scott', 22);


INSERT INTO acl_permission VALUES (null, 4, 'dianne', 1);
INSERT INTO acl_permission VALUES (null, 5, 'dianne', 2);
INSERT INTO acl_permission VALUES (null, 6, 'dianne', 22);
INSERT INTO acl_permission VALUES (null, 8, 'dianne', 2);




CREATE TABLE USERS(USERNAME VARCHAR_IGNORECASE(50) NOT NULL PRIMARY KEY,PASSWORD VARCHAR_IGNORECASE(50) NOT NULL,ENABLED BOOLEAN NOT NULL);
CREATE TABLE AUTHORITIES(USERNAME VARCHAR_IGNORECASE(50) NOT NULL,AUTHORITY VARCHAR_IGNORECASE(50) NOT NULL,CONSTRAINT FK_AUTHORITIES_USERS FOREIGN KEY(USERNAME) REFERENCES USERS(USERNAME));
CREATE UNIQUE INDEX IX_AUTH_USERNAME ON AUTHORITIES(USERNAME,AUTHORITY);
INSERT INTO USERS VALUES('marissa','a564de63c2d0da68cf47586ee05984d7',TRUE);
INSERT INTO USERS VALUES('dianne','65d15fe9156f9c4bbffd98085992a44e',TRUE);
INSERT INTO USERS VALUES('scott','2b58af6dddbd072ed27ffc86725d7d3a',TRUE);
INSERT INTO USERS VALUES('peter','22b5c9accc6e1ba628cedc63a72d57f8',FALSE);
INSERT INTO AUTHORITIES VALUES('marissa','ROLE_USER');
INSERT INTO AUTHORITIES VALUES('marissa','ROLE_SUPERVISOR');
INSERT INTO AUTHORITIES VALUES('dianne','ROLE_USER');
INSERT INTO AUTHORITIES VALUES('scott','ROLE_USER');
INSERT INTO AUTHORITIES VALUES('peter','ROLE_USER');

I 'm sure that the recorder was binded to "dianne" here.

INSERT INTO acl_permission VALUES (null, 4, 'dianne', 1);
INSERT INTO acl_permission VALUES (null, 5, 'dianne', 2);
INSERT INTO acl_permission VALUES (null, 6, 'dianne', 22);
INSERT INTO acl_permission VALUES (null, 8, 'dianne', 2);

and the recorder is specify to a real Contact

INSERT INTO acl_object_identity VALUES (1, 'sample.contact.Contact:1', null, 'net.sf.acegisecurity.acl.basic.SimpleAclEntry');

but I didn't find where and how it process
'sample.contact.Contact:1'

INSERT INTO acl_object_identity VALUES (1, 'sample.contact.Contact:1', null, 'net.sf.acegisecurity.acl.basic.SimpleAclEntry');
INSERT INTO acl_object_identity VALUES (2, 'sample.contact.Contact:2', null, 'net.sf.acegisecurity.acl.basic.SimpleAclEntry');
INSERT INTO acl_object_identity VALUES (3, 'sample.contact.Contact:3', null, 'net.sf.acegisecurity.acl.basic.SimpleAclEntry');
INSERT INTO acl_object_identity VALUES (4, 'sample.contact.Contact:4', null, 'net.sf.acegisecurity.acl.basic.SimpleAclEntry');
INSERT INTO acl_object_identity VALUES (5, 'sample.contact.Contact:5', null, 'net.sf.acegisecurity.acl.basic.SimpleAclEntry');
INSERT INTO acl_object_identity VALUES (6, 'sample.contact.Contact:6', null, 'net.sf.acegisecurity.acl.basic.SimpleAclEntry');
INSERT INTO acl_object_identity VALUES (7, 'sample.contact.Contact:7', null, 'net.sf.acegisecurity.acl.basic.SimpleAclEntry');
INSERT INTO acl_object_identity VALUES (8, 'sample.contact.Contact:8', null, 'net.sf.acegisecurity.acl.basic.SimpleAclEntry');
INSERT INTO acl_object_identity VALUES (9, 'sample.contact.Contact:9', null, 'net.sf.acegisecurity.acl.basic.SimpleAclEntry');

[Ben Alex]

The MethodSecurityInterceptor is weaved in using AOP and it in turn loads an AfterInvocationManager containing the Collection of all Contacts. The BasicAclEntryAfterInvocationCollectionProvider is then used to filter the unauthorised Contacts from the Collection. It does this by referring to the AclManager, which in turn delegates to the BasicAclProvider. The BasicAclProvider uses JdbcDaoImpl to convert the String representation of "sample.contact.Contact:1" into a NamedEntityObjectIdentity that represents the Contact class with an id of 1. The BasicAclProvider is thus able to identify the Object obtained from the Collection that it was passed via the AclManager and the corresponding ACL records. I know this seems confusing when written this way - the reference guide does a better job of explaining all the key actors.