CODEWITHSUNDEEP
spring-securityacl
Philipp Jardas
Philipp Jardas

Reputation: 3302

How to grant ACL in Spring Security without an explicit authentication?

When I create a new entity I would like to grant ACL permissions (aka ACL entry) to this new entity. So far so easy :-)

The problem arises in the following scenario:

Spring's JdbcMutableAclService uses SecurityContextHolder.getContext().getAuthentication() to obtain the current authentication, so there seems to be no way to circumvent this requirement.

Any ideas are greatly appreciated!

Upvotes: 3

Views: 723

Answers (1)

Philipp Jardas
Philipp Jardas

Reputation: 3302

Found the answer myself:

In a web application there always is an authentication context. If a user is not authenticated the authentication is org.springframework.security.authentication.AnonymousAuthenticationToken which has a single granted authority: ROLE_ANONYMOUS.

Hence it is simple to grant this user the right to create ACLs. Just configure the PermissionGrantingStrategy to use this role to authorize requests.

Upvotes: 2

Related Questions