Question

I want to extend the permissions given for an user to an entity.

I am able to create ACLs via MutableAclService.

MutableAcl acl = this.mutableAclService.createAcl(new ObjectIdentityImpl(entity));            
acl.setOwner(SYSTEM_PRINCIPAL_SID);
acl.insertAce(0, permission, grantToSid, true);
this.mutableAclService.updateAcl(acl);

But I don’t know how to change ACLs. For example if a user has Read Privileges to an entity, I want to provide him additional Write Privileges.
Or give an other user the same privileges.

---

My first try was to invoke MutableAclService.createAcl twice, but that failed:

org.springframework.security.acls.model.AlreadyExistsException: Object identity ‘org.springframework.security.acls.domain.ObjectIdentityImpl[Type: test.Entity; Identifier: 3]’ already exists

Ok that seams to be correct, wrong way. But how to do it then? How to change the acl permissions for an entity where already some permissions are defined?

Answer 1

I have had a look at the code, and it seams that there is only one relevant implementation of the ACL interface: AclImpl.

This class implements the MutableAcl interface and is returned by the AclService functions.

So I decided to cast the results from Acl to MutableAcl. Up to now it is working and I did not get an problem or Class cast exception:

MutableAcl existingAcl = (MutableAcl) mutableAclService.readAclById(oid, sids);
...
mutableAclService.updateAcl(existingAcl);