5

I'm reading about Spring Security and wonder whether it's possible to use Spring ACL together with hibernate and pagination. The resulting SQL is surely scary but possible to be auto-generated. It's even possible to use hierarchical ACL if the database supports recursive query evaluation.

Using a post filter is no solution since it breaks pagination and is an unnecessary overhead compared to ACL filtering inside the database.

So I actually have the pieces to build a solution. I want to know whether somebody has already done it.

Links:

Community
  • 1
  • 1
Thomas Koch
  • 2,833
  • 2
  • 28
  • 36

2 Answers2

1

Yes there are solutions to your challenge. The field is called dynamic data masking and dynamic data filtering.

The idea is that you will have a proxy sit between your application and database. The proxy will apply the filtering such that only relevant authorized data is returned to the app hence keeping pagination intact.

Have a look at:

  • GreenSQL
  • Axiomatics Data Access Filter MD (demo)
David Brossard
  • 13,584
  • 6
  • 55
  • 88
1

The way I dealing with this is first by getting a list of IDs my user has access to with the solution I gave here.

I then uses this list of IDs to do a query IN with that list.

Community
  • 1
  • 1
denov
  • 11,180
  • 2
  • 27
  • 43