| Given a domain object instance returned from a secure object invocation, ensures the principal has
appropriate permission as defined by the
AclManager .
The AclManager is used to retrieve the access control list (ACL) permissions associated with a
domain object instance for the current Authentication object. This class is designed to process
AclEntry s that are subclasses of
org.acegisecurity.acl.basic.BasicAclEntry only. Generally these are
obtained by using the
org.acegisecurity.acl.basic.BasicAclProvider .
This after invocation provider will fire if any
ConfigAttribute.getAttribute matches the
BasicAclEntryAfterInvocationProvider.processConfigAttribute . The provider will then lookup the ACLs from the AclManager and ensure the
principal is
org.acegisecurity.acl.basic.BasicAclEntry.isPermitted(int) for at least one of the
BasicAclEntryAfterInvocationProvider.requirePermission s.
Often users will setup a BasicAclEntryAfterInvocationProvider with a
BasicAclEntryAfterInvocationProvider.processConfigAttribute of AFTER_ACL_READ and a
BasicAclEntryAfterInvocationProvider.requirePermission of
SimpleAclEntry.READ. These are also the defaults.
If the principal does not have sufficient permissions, an AccessDeniedException will be thrown.
The AclManager is allowed to return any implementations of AclEntry it wishes.
However, this provider will only be able to validate against BasicAclEntrys, and thus access will be
denied if no AclEntry is of type BasicAclEntry.
If the provided returnObject is null, permission will always be granted and
null will be returned.
All comparisons and prefixes are case sensitive.
| 