I have been trying to figure out an ACL solution for my application which should manage API endpoint's access rights dynamically. Some said that I have an option of Spring Security ACL. I checked it but lack of documentation frightened me a bit. So that I started to design my own ACL implementation; since I did not start implementation can not provide code example but at least I can provide the flow and components planned to be used.
- A security configuration service. Which will interact with required services to provide dao services between application and database (ofc this will have ref to DAO class as well)
- A new annotation to be used with aspect to tag/label all endpoints and to catch through aspect.
- An aspect service to intercept requests and check authorization.
So this a highly overall idea above definitions with their required helpers.
I will trigger aspect per end point access request. Since I know the label for the endpoint (written in the annotation) I can simply cross-check the access rule and user's roles ( I will access it through the Authentication object of Spring).
Any suggestion or a flaw I am missing here ?