| Given a domain object instance returned from a secure object invocation, ensures the principal has
appropriate permission as defined by the
AclService .
The AclService is used to retrieve the access control list (ACL) permissions associated with a
domain object instance for the current Authentication object.
This after invocation provider will fire if any
ConfigAttribute.getAttribute matches the
AclEntryAfterInvocationProvider.processConfigAttribute . The provider will then lookup the ACLs from the AclService and ensure the
principal is
org.acegisecurity.acls.Acl.isGranted(org.acegisecurity.acls.Permission[]org.acegisecurity.acls.sid.Sid[]boolean) Acl.isGranted(Permission[], Sid[], boolean) when presenting the
AclEntryAfterInvocationProvider.requirePermission array to that method.
Often users will setup an AclEntryAfterInvocationProvider with a
AclEntryAfterInvocationProvider.processConfigAttribute of AFTER_ACL_READ and a
AclEntryAfterInvocationProvider.requirePermission of
BasePermission.READ. These are also the defaults.
If the principal does not have sufficient permissions, an AccessDeniedException will be thrown.
If the provided returnObject is null, permission will always be granted and
null will be returned.
All comparisons and prefixes are case sensitive.
| 