Spring Security ACL Plugin - Reference Documentation

dependencies {
   ...
   compile 'org.grails.plugins:spring-security-acl:3.1.1'
   ...
}

package com.testacl

class Report {
   String name
}

package com.testacl

import static org.springframework.security.acls.domain.BasePermission.ADMINISTRATION

import org.springframework.security.access.prepost.PostFilter
import org.springframework.security.access.prepost.PreAuthorize
import org.springframework.security.acls.domain.DefaultPermissionFactory
import org.springframework.security.acls.model.AccessControlEntry
import org.springframework.security.acls.model.MutableAcl
import org.springframework.security.acls.model.Permission
import org.springframework.security.acls.model.Sid

import grails.compiler.GrailsCompileStatic
import grails.plugin.springsecurity.SpringSecurityService
import grails.plugin.springsecurity.acl.AclService
import grails.plugin.springsecurity.acl.AclUtilService
import grails.transaction.Transactional

@GrailsCompileStatic
class ReportService {

   DefaultPermissionFactory aclPermissionFactory
   AclService aclService
   AclUtilService aclUtilService
   SpringSecurityService springSecurityService

   void addPermission(Report report, String username, int permission) {
      addPermission report, username, aclPermissionFactory.buildFromMask(permission)
   }

   @PreAuthorize('hasPermission(#report, admin)')
   @Transactional
   void addPermission(Report report, String username, Permission permission) {
      aclUtilService.addPermission report, username, permission
   }

   @Transactional
   @PreAuthorize('hasRole("ROLE_USER")')
   Report create(String name) {
      Report report = new Report(name: name).save(failOnError: true)

      // Grant the current principal administrative permission
      addPermission report, springSecurityService.authentication.name, ADMINISTRATION

      report
   }

   @PreAuthorize('hasPermission(#id, "com.testacl.Report", read) or hasPermission(#id, "com.testacl.Report", admin)')
   Report get(long id) {
      Report.get id
   }

   @PreAuthorize('hasRole("ROLE_USER")')
   @PostFilter('hasPermission(filterObject, read) or hasPermission(filterObject, admin)')
   List<Report> list(Map params) {
      Report.list params
   }

   int count() {
      Report.count()
   }

   @Transactional
   @PreAuthorize('hasPermission(#report, write) or hasPermission(#report, admin)')
   void update(Report report, String name) {
      report.name = name
   }

   @Transactional
   @PreAuthorize('hasPermission(#report, delete) or hasPermission(#report, admin)')
   void delete(Report report) {
      report.delete()

      // Delete the ACL information as well
      aclUtilService.deleteAcl report
   }

   @Transactional
   @PreAuthorize('hasPermission(#report, admin)')
   void deletePermission(Report report, Sid recipient, Permission permission) {
      MutableAcl acl = (MutableAcl)aclUtilService.readAcl(report)

      // Remove all permissions associated with this particular
      // recipient (string equality to KISS)
      acl.entries.eachWithIndex { AccessControlEntry entry, int i ->
         if (entry.sid == recipient && entry.permission == permission) {
            acl.deleteAce i
         }
      }

      aclService.updateAcl acl
   }
}

package com.testacl

import static org.springframework.security.acls.domain.BasePermission.ADMINISTRATION
import static org.springframework.security.acls.domain.BasePermission.READ
import static org.springframework.security.acls.domain.BasePermission.WRITE

import org.springframework.security.authentication.UsernamePasswordAuthenticationToken
import org.springframework.security.core.authority.AuthorityUtils
import org.springframework.security.core.context.SecurityContextHolder as SCH

import grails.transaction.Transactional

@Transactional
class SampleDataService {

   def aclService
   def aclUtilService
   def objectIdentityRetrievalStrategy

   void createSampleData() {
      createUsers()
      loginAsAdmin()
      grantPermissions()

      // logout
      SCH.clearContext()
   }

   private void loginAsAdmin() {
      // have to be authenticated as an admin to create ACLs
      SCH.context.authentication = new UsernamePasswordAuthenticationToken(
         'admin', 'admin123',
         AuthorityUtils.createAuthorityList('ROLE_ADMIN'))
   }

   private void createUsers() {
      def roleAdmin = new Role(authority: 'ROLE_ADMIN').save()
      def roleUser = new Role(authority: 'ROLE_USER').save()

      3.times {
         long id = it + 1
         def user = new User("user$id", "password$id").save()
         UserRole.create user, roleUser
      }

      def admin = new User('admin', 'admin123').save()

      UserRole.create admin, roleUser
      UserRole.create admin, roleAdmin
   }

   private void grantPermissions() {
      def reports = []
      100.times {
         long id = it + 1
         def report = new Report(name: "report$id").save()
         reports << report
         aclService.createAcl(
                 objectIdentityRetrievalStrategy.getObjectIdentity(report))
      }

      // grant user 1 admin on 11,12 and read on 1-67
      aclUtilService.addPermission reports[10], 'user1', ADMINISTRATION
      aclUtilService.addPermission reports[11], 'user1', ADMINISTRATION
      67.times {
         aclUtilService.addPermission reports[it], 'user1', READ
      }

      // grant user 2 read on 1-5, write on 5
      5.times {
         aclUtilService.addPermission reports[it], 'user2', READ
      }
      aclUtilService.addPermission reports[4], 'user2', WRITE

      // user 3 has no grants

      // grant admin admin on all
      for (report in reports) {
         aclUtilService.addPermission report, 'admin', ADMINISTRATION
      }

      // grant user 1 ownership on 1,2 to allow the user to grant
      aclUtilService.changeOwner reports[0], 'user1'
      aclUtilService.changeOwner reports[1], 'user1'
   }
}

class BootStrap {

   def sampleDataService

   def init = {
      sampleDataService.createSampleData()
   }
}

package com.testacl

import org.springframework.dao.DataIntegrityViolationException

import grails.plugin.springsecurity.annotation.Secured

@Secured('ROLE_USER')
class ReportController {

   def reportService

   def index() {
      params.max = Math.min(params.max ? params.int('max') : 10, 100)
      [reportList: reportService.list(params),
       reportCount: reportService.count()]
   }

   def create() {
      [report: new Report(params)]
   }

   def save() {
      def report = reportService.create(params.name)
      if (!renderWithErrors('create', report)) {
         redirectShow "Report $report.id created", report.id
      }
   }

   def show() {
      def report = findInstance()
      if (!report) return

      [report: report]
   }

   def edit() {
      def report = findInstance()
      if (!report) return

      [report: report]
   }

   def update() {
      def report = findInstance()
      if (!report) return

      reportService.update report, params.name
      if (!renderWithErrors('edit', report)) {
         redirectShow "Report $report.id updated", report.id
      }
   }

   def delete() {
      def report = findInstance()
      if (!report) return

      try {
         reportService.delete report
         flash.message = "Report $params.id deleted"
         redirect action: 'list'
      }
      catch (DataIntegrityViolationException e) {
         redirectShow "Report $params.id could not be deleted", params.id
      }
   }

   def grant() {

      def report = findInstance()
      if (!report) return

      if (!request.post) {
         return [report: report]
      }

      reportService.addPermission(report, params.recipient,
              params.int('permission'))

      redirectShow "Permission $params.permission granted on Report $report.id " +
              "to $params.recipient", report.id
   }

   private Report findInstance() {
      def report = reportService.get(params.long('id'))
      if (!report) {
         flash.message = "Report not found with id $params.id"
         redirect action: 'list'
      }
      report
   }

   private void redirectShow(message, id) {
      flash.message = message
      redirect action: 'show', id: id
   }

   private boolean renderWithErrors(String view, Report report) {
      if (report.hasErrors()) {
         render view: view, model: [report: report]
         return true
      }
      false
   }
}

import org.springframework.security.access.AccessDeniedException
import org.springframework.security.acls.model.NotFoundException

class UrlMappings {

   static mappings = {

      ...

      "403"(controller: 'errors', action: 'error403')
      "404"(controller: 'errors', action: 'error404')
      "500"(controller: 'errors', action: 'error500')
      "500"(controller: 'errors', action: 'error403',
            exception: AccessDeniedException)
      "500"(controller: 'errors', action: 'error403',
            exception: NotFoundException)
   }
}

package com.testacl

import grails.plugin.springsecurity.annotation.Secured

@Secured('permitAll')
class ErrorsController {

   def error403() {}

   def error404() {
      render view: '/notFound'
   }

   def error500() {
      render view: '/error'
   }
}

<html>
<head>
<title>Access denied!</title>
<meta name='layout' content='main' />
</head>

<body>
<h1>Access Denied</h1>
<p>We're sorry, but you are not authorized
   to perform the requested operation.</p>
</body>
</html>