Question

I have read about Spring ACL but it does not seem to be very competent. For example:

1. No way to list all objects of type X with permission Y
2. No way to automatically create the schemas for new deployments

What are you using for ACL? Is it clever to have the ACL so decoupled from the domain model?

Answer 1

We attempted to use the Spring ACL model and found it unwieldy. We ended up rolling our own, much simpler (but also less generic), implementation and then writing the Spring Security pieces (accessDecisionManagers, Voters, Interceptors) to handle our schema. Hope that helps.