In the context of a Spring Boot application, I'm using Spring Security ACLs to enforce permissions on objects of a given class. The user who creates the object gets ADMINISTRATION permissions, and he can choose to give additional READ and WRITE permissions on that object to user users of the application. The target users can then see the objects that have been shared with them in their dashboard.
Currently, only the user with ADMINISTRATION permission is able to revoke the READ and WRITE permissions for other users on a given object, which is not very user friendly. I'd like to allow the target users to revoke those permissions as well, in case they're not interested in seeing a particular object anymore.
Unfortunately, this does not seems to work out of the box. Trying to call acl.deleteAce() from the context of a target user gives me an org.springframework.security.acls.model.NotFoundException: Unable to locate a matching ACE for passed permissions and SIDs.
How can I solve this issue? Things I'm currently considering:
- Insert an ACE with
BasePermission.ADMINISTRATIONin the context of the target user before deleting the target user ACEs -> seems to trigger the same exception. - Temporarily impersonating the user with
ADMINISTRATIONpermission while removing the ACEs from the ACL. - Directly deleting the ACEs from the database, i.e. bypassing
acl.deleteAce().
Possibly related but it's not clear how to actually implement the proposed solution: Spring Security update acl when not owner