Spring Security - is Role and ACL security overkill?

Question

I have a 3 tier application that requires security authorizations be placed on various domain objects.

Whether I use Spring's ACL implementation or roll my own, it seems to me that ACL based security can only be used to authorize (service) methods and cannot be used to authorize URL or web service invocations. I think this because how could a web service call check the ACL before it has hydrated the XML payload? Also, all the examples for web access security in the Spring documentation are securing URL's based on Role.

Is it typical to use Spring's roles to secure web presentation and web service calls, while at the same time using ACL's to secure the business methods? Is this overkill?

Answer 1

Is it typical to use Spring's roles to secure web presentation and web service calls, while at the same time using ACL's to secure the business methods?

Yes.

This is simple to do in your controller by combining the request mapping and secured annotations:

@RequestMapping("/some/url")
@Secured( {"ROLE_GET_THE_DATA"} )
public ModelAndView getTheData(HttpServletRequest request,
                             HttpServletResponse response) throws Exception {    
    // get the data
    // return it in your mav
}

Adding secured annotations to you data access objects (DAO) will complete the security design.

Is this overkill?

That depends on your application. Minimally you should secure your controller. Not securing your DAOs may introduce security holes in the future.

We are working on adding this type of security to our applications.