spring-projects / spring-projects/spring-security
Spring Security ACL based on MongoDB
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Spring Security ACL is, by its current implementation, based on SQL databases which joins together all 4 tables (sid, class, object_identity & access_control_entry) on lookup time. Some projects (1,2,3) added support for MongoDB to avoid having to join these 4 tables on every lookup (if no cache hit was found) and utilize the flexibility of embedded documents.
A similar question was also raised on StackOverflow asking if there is a performance reason to support only SQL based databases but not NoSQL ones.
As I have also implemented a MongoDB based ACL Spring Security Service (3), I wanted to ask if there is generel interest to include this (or any of the other projects) into the Spring Security codebase. I am aware that some modifications to the code (to adhere to the general guidelines) has yet to be done, but before putting in more work I just wanted to make sure if there is general interest otherwise my time is probably better spent elsewhere :)
I've also ported the contact ACL sample (4) to use my MongoDB ACL implementation (3) in order to showcase its functionality on an existing sample that made use of ACL.
1 Implementation by Peter Arsentev
2 Implementation by Alex Czar (though forked from somewhere else I guess)
3 Implementation by Roman Vottner
4 Contact ACL Sample port to MongoDB ACL
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Review the existing Spring Security ACL implementation and compare it with the linked MongoDB implementations, including the ported contact ACL sample. First determine whether maintainers want MongoDB-backed ACL support; a useful outcome would be a confirmed scope and project decision before implementation begins.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, mongodb, spring
- Domain
- databases, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100