如何在Spring security acl中删除某些Sid的AccessControlEntry（acl_entry）？

Question

如何使用 mutableAclService 删除 spring security acl 中的用户访问权限。这段代码可以吗

private  void deleteEntry(Long id){

        ObjectIdentity objectIdentity = new ObjectIdentityImpl(OrganizationStructure.class, id);

        Sid user = new PrincipalSid("admin");
        Permission p1 = BasePermission.READ;

        try {
            MutableAcl acl = (MutableAcl) mutableAclService.readAclById(objectIdentity);
            acl.getEntries().forEach(c->{
                System.out.println(c.toString());
                if(c.getSid().equals(user))
                    acl.getEntries().remove(c);
            });
            mutableAclService.updateAcl(acl);

        } catch (NotFoundException nfe) {
        }

    }

Answer 1

如果列表中同一 SID 存在多个访问控制条目，则上述代码将失败。此外，如果 ACL 中没有留下任何条目，您可能希望完全删除它。这是一个稍微改进的版本：

    ObjectIdentity oi = new ObjectIdentityImpl(objectClass, objectId);
    try {
        MutableAcl acl = (MutableAcl) aclService.readAclById(oi);
        List<AccessControlEntry> aclEntries = acl.getEntries();
        for (int i = aclEntries.size() - 1; i >= 0; i--) {
            AccessControlEntry ace = aclEntries.get(i);
            if (ace.getSid().equals(sid)) {
                acl.deleteAce(i);
            }
        }
        if (acl.getEntries().isEmpty()) {
            aclService.deleteAcl(oi, true);
        }
        aclService.updateAcl(acl);
    } catch (NotFoundException ignore) {
    }