spring-projects / spring-projects/spring-security
SEC-2409: Spring Security / Spring Data Acl Integration
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Rob Winch (Migrated from SEC-2409) said:
Spring Security's ACL implementation allows users to determine if a access is allowed after the results come back from the database. This works when there is a small number of results, but breaks down when paging is necessary. Now that we have Spring Data, it would be good to provide integration with Spring Data to ensure that the query's are automatically updated based upon the security restrictions. We could provide a default strategy that aligns with Spring Security's ACL model.
Blocked by https://github.com/spring-projects/spring-data-commons/issues/766
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Review Spring Security's ACL implementation and the Spring Data integration requirement, then inspect the blocking spring-data-commons issue 766. Done means Spring Data queries are automatically updated for security restrictions, with a default strategy aligned with Spring Security's ACL model.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- authorization, backend-api-design, database, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100