spring security acl

在项目的权限处理要实现细粒度的权限。这个几天特意从网上找了一些资料。自己整理一下。我研究的是官方例子contract.
CREATE TABLE ACL_SID(
ID BIGINT AUTO_INCREMENT NOT NULL PRIMARY KEY,
PRINCIPAL BOOLEAN NOT NULL,
SID VARCHAR(100) NOT NULL,
CONSTRAINT UNIQUE_UK_1 UNIQUE(SID,PRINCIPAL)
);


CREATE TABLE ACL_CLASS(
ID BIGINT AUTO_INCREMENT NOT NULL PRIMARY KEY,
CLASS VARCHAR(100) NOT NULL,
CONSTRAINT UNIQUE_UK_2 UNIQUE(CLASS)
);


CREATE TABLE ACL_OBJECT_IDENTITY(
ID BIGINT AUTO_INCREMENT NOT NULL PRIMARY KEY,
OBJECT_ID_CLASS BIGINT NOT NULL,
OBJECT_ID_IDENTITY BIGINT NOT NULL,
PARENT_OBJECT BIGINT,
OWNER_SID BIGINT,
ENTRIES_INHERITING BOOLEAN NOT NULL,
CONSTRAINT UNIQUE_UK_3 UNIQUE(OBJECT_ID_CLASS, OBJECT_ID_IDENTITY),
CONSTRAINT FOREIGN_FK_1 FOREIGN KEY(PARENT_OBJECT)REFERENCES ACL_OBJECT_IDENTITY(ID),
CONSTRAINT FOREIGN_FK_2 FOREIGN KEY(OBJECT_ID_CLASS)REFERENCES ACL_CLASS(ID),
CONSTRAINT FOREIGN_FK_3 FOREIGN KEY(OWNER_SID)REFERENCES ACL_SID(ID)
);


CREATE TABLE ACL_ENTRY(
ID BIGINT AUTO_INCREMENT NOT NULL PRIMARY KEY,
ACL_OBJECT_IDENTITY BIGINT NOT NULL,
ACE_ORDER INT NOT NULL,
SID BIGINT NOT NULL,
MASK INTEGER NOT NULL,
GRANTING BOOLEAN NOT NULL,
AUDIT_SUCCESS BOOLEAN NOT NULL,
AUDIT_FAILURE BOOLEAN NOT NULL,
CONSTRAINT UNIQUE_UK_4 UNIQUE(ACL_OBJECT_IDENTITY,ACE_ORDER),
CONSTRAINT FOREIGN_FK_4 FOREIGN KEY(ACL_OBJECT_IDENTITY) REFERENCES ACL_OBJECT_IDENTITY(ID),
CONSTRAINT FOREIGN_FK_5 FOREIGN KEY(SID) REFERENCES ACL_SID(ID)
);

CREATE TABLE USERS(
USERNAME VARCHAR(50) NOT NULL PRIMARY KEY,
PASSWORD VARCHAR(50) NOT NULL,
ENABLED BOOLEAN NOT NULL
);
CREATE TABLE AUTHORITIES(
USERNAME VARCHAR(50) NOT NULL,
AUTHORITY VARCHAR(50) NOT NULL,
CONSTRAINT FK_AUTHORITIES_USERS FOREIGN KEY(USERNAME) REFERENCES USERS(USERNAME)
);
CREATE UNIQUE INDEX IX_AUTH_USERNAME ON AUTHORITIES(USERNAME,AUTHORITY);
CREATE TABLE CONTACTS(
ID BIGINT NOT NULL PRIMARY KEY,
CONTACT_NAME VARCHAR(50) NOT NULL,
EMAIL VARCHAR(50) NOT NULL
);

ss的acl是基于domain类型的控制method方法的拦截tablib控制显示内容AfterInvocation后置拦截。上面是他用到的表结构
ACL_SID:可能是一个具体的用户，也可能是一个角色名，用来标识一组具有相同身份的用户
OBJECT_IDENTITY:由domain(就是我们要控制的pojo类)的类型和pojo的主键组成.
ACL_ENTRY:保存某个SID可以对某个OBJECT_IDENTITY进行哪些操作.

方法的拦截:spring security 只能拦截services方法
页面中使用<sec:acl />