SEC-1038: Changed JdbcMutableAclServiceTests to facilitate testing with PostgreSQL and updated JdbcMutableAclService to use a the id obtained from the ObjectIdentity directly rather than calling toString() on it before passing to the JDBC call.

acl/src/main/java/org/springframework/security/acls/jdbc/JdbcMutableAclService.java

@@ -42,7 +42,14 @@ import org.springframework.util.Assert;
 
 
 /**
- * Provides a base implementation of {@link MutableAclService}.
+ * Provides a base JDBC implementation of {@link MutableAclService}.
+ * <p>
+ * The default settings are for HSQLDB. If you are using a different database you
+ * will probably need to set the {@link #setSidIdentityQuery(String) sidIdentityQuery} and
+ * {@link #setClassIdentityQuery(String) classIdentityQuery} properties appropriately.
+ * <p>
+ * See the appendix of the Spring Security reference manual for more information on the expected schema
+ * and how it is used. Information on using PostgreSQL is also included.
  *
  * @author Ben Alex
  * @author Johannes Zlattinger
@@ -55,8 +62,8 @@ public class JdbcMutableAclService extends JdbcAclService implements MutableAclS
     private AclCache aclCache;
     private String deleteEntryByObjectIdentityForeignKey = "delete from acl_entry where acl_object_identity=?";
     private String deleteObjectIdentityByPrimaryKey = "delete from acl_object_identity where id=?";
-    private String classIdentityQuery = "call identity()"; // should be overridden for postgres : select currval('acl_class_seq')
-    private String sidIdentityQuery = "call identity()"; // should be overridden for postgres : select currval('acl_siq_seq')
+    private String classIdentityQuery = "call identity()";
+    private String sidIdentityQuery = "call identity()";
     private String insertClass = "insert into acl_class (class) values (?)";
     private String insertEntry = "insert into acl_entry "
         + "(acl_object_identity, ace_order, sid, mask, granting, audit_success, audit_failure)"
@@ -142,7 +149,7 @@ public class JdbcMutableAclService extends JdbcAclService implements MutableAclS
     protected void createObjectIdentity(ObjectIdentity object, Sid owner) {
         Long sidId = createOrRetrieveSidPrimaryKey(owner, true);
         Long classId = createOrRetrieveClassPrimaryKey(object.getJavaType(), true);
-        jdbcTemplate.update(insertObjectIdentity, classId, object.getIdentifier().toString(), sidId, Boolean.TRUE);
+        jdbcTemplate.update(insertObjectIdentity, classId, object.getIdentifier(), sidId, Boolean.TRUE);
     }
 
     /**
@@ -354,14 +361,26 @@ public class JdbcMutableAclService extends JdbcAclService implements MutableAclS
         }
     }
 
-    public void setClassIdentityQuery(String identityQuery) {
-        Assert.hasText(identityQuery, "New identity query is required");
-        this.classIdentityQuery = identityQuery;
+    /**
+     * Sets the query that will be used to retrieve the identity of a newly created row in the <tt>acl_class</tt>
+     * table.
+     *
+     * @param classIdentityQuery the query, which should return the identifier. Defaults to <tt>call identity()</tt>
+     */
+    public void setClassIdentityQuery(String classIdentityQuery) {
+        Assert.hasText(classIdentityQuery, "New classIdentityQuery query is required");
+        this.classIdentityQuery = classIdentityQuery;
     }
 
-    public void setSidIdentityQuery(String identityQuery) {
-        Assert.hasText(identityQuery, "New identity query is required");
-        this.sidIdentityQuery = identityQuery;
+    /**
+     * Sets the query that will be used to retrieve the identity of a newly created row in the <tt>acl_sid</tt>
+     * table.
+     *
+     * @param sidIdentityQuery the query, which should return the identifier. Defaults to <tt>call identity()</tt>
+     */
+    public void setSidIdentityQuery(String sidIdentityQuery) {
+        Assert.hasText(sidIdentityQuery, "New sidIdentityQuery query is required");
+        this.sidIdentityQuery = sidIdentityQuery;
     }
     /**
      * @param foreignKeysInDatabase if false this class will perform additional FK constrain checking, which may

acl/src/main/resources/createAclSchema.sql

@@ -1,43 +1,46 @@
--- ACL Schema SQL
+-- ACL schema sql used in HSQLDB
 
--- DROP TABLE ACL_ENTRY;
--- DROP TABLE ACL_OBJECT_IDENTITY;
--- DROP TABLE ACL_CLASS;
--- DROP TABLE ACL_SID;
+-- drop table acl_entry;
+-- drop table acl_object_identity;
+-- drop table acl_class;
+-- drop table acl_sid;
 
 
-CREATE TABLE ACL_SID(
-ID BIGINT GENERATED BY DEFAULT AS IDENTITY(START WITH 100) NOT NULL PRIMARY KEY,
-PRINCIPAL BOOLEAN NOT NULL,
-SID VARCHAR_IGNORECASE(100) NOT NULL,
-CONSTRAINT UNIQUE_UK_1 UNIQUE(SID,PRINCIPAL));
+create table acl_sid(
+    id bigint generated by default as identity(start with 100) not null primary key,
+    principal boolean not null,
+    sid varchar_ignorecase(100) not null,
+    constraint unique_uk_1 unique(sid,principal));
 
-CREATE TABLE ACL_CLASS(
-ID BIGINT GENERATED BY DEFAULT AS IDENTITY(START WITH 100) NOT NULL PRIMARY KEY,
-CLASS VARCHAR_IGNORECASE(100) NOT NULL,
-CONSTRAINT UNIQUE_UK_2 UNIQUE(CLASS));
+create table acl_class(
+    id bigint generated by default as identity(start with 100) not null primary key,
+    class varchar_ignorecase(100) not null,
+    constraint unique_uk_2 unique(class)
+);
 
-CREATE TABLE ACL_OBJECT_IDENTITY(
-ID BIGINT GENERATED BY DEFAULT AS IDENTITY(START WITH 100) NOT NULL PRIMARY KEY,
-OBJECT_ID_CLASS BIGINT NOT NULL,
-OBJECT_ID_IDENTITY BIGINT NOT NULL,
-PARENT_OBJECT BIGINT,
-OWNER_SID BIGINT,
-ENTRIES_INHERITING BOOLEAN NOT NULL,
-CONSTRAINT UNIQUE_UK_3 UNIQUE(OBJECT_ID_CLASS,OBJECT_ID_IDENTITY),
-CONSTRAINT FOREIGN_FK_1 FOREIGN KEY(PARENT_OBJECT)REFERENCES ACL_OBJECT_IDENTITY(ID),
-CONSTRAINT FOREIGN_FK_2 FOREIGN KEY(OBJECT_ID_CLASS)REFERENCES ACL_CLASS(ID),
-CONSTRAINT FOREIGN_FK_3 FOREIGN KEY(OWNER_SID)REFERENCES ACL_SID(ID));
+create table acl_object_identity(
+    id bigint generated by default as identity(start with 100) not null primary key,
+    object_id_class bigint not null,
+    object_id_identity bigint not null,
+    parent_object bigint,
+    owner_sid bigint,
+    entries_inheriting boolean not null,
+    constraint unique_uk_3 unique(object_id_class,object_id_identity),
+    constraint foreign_fk_1 foreign key(parent_object)references acl_object_identity(id),
+    constraint foreign_fk_2 foreign key(object_id_class)references acl_class(id),
+    constraint foreign_fk_3 foreign key(owner_sid)references acl_sid(id)
+);
 
-CREATE TABLE ACL_ENTRY(
-ID BIGINT GENERATED BY DEFAULT AS IDENTITY(START WITH 100) NOT NULL PRIMARY KEY,
-ACL_OBJECT_IDENTITY BIGINT NOT NULL,
-ACE_ORDER INT NOT NULL,
-SID BIGINT NOT NULL,
-MASK INTEGER NOT NULL,
-GRANTING BOOLEAN NOT NULL,
-AUDIT_SUCCESS BOOLEAN NOT NULL,
-AUDIT_FAILURE BOOLEAN NOT NULL,
-CONSTRAINT UNIQUE_UK_4 UNIQUE(ACL_OBJECT_IDENTITY,ACE_ORDER),
-CONSTRAINT FOREIGN_FK_4 FOREIGN KEY(ACL_OBJECT_IDENTITY) REFERENCES ACL_OBJECT_IDENTITY(ID),
-CONSTRAINT FOREIGN_FK_5 FOREIGN KEY(SID) REFERENCES ACL_SID(ID));
+create table acl_entry(
+    id bigint generated by default as identity(start with 100) not null primary key,
+    acl_object_identity bigint not null,
+    ace_order int not null,
+    sid bigint not null,
+    mask integer not null,
+    granting boolean not null,
+    audit_success boolean not null,
+    audit_failure boolean not null,
+    constraint unique_uk_4 unique(acl_object_identity,ace_order),
+    constraint foreign_fk_4 foreign key(acl_object_identity) references acl_object_identity(id),
+    constraint foreign_fk_5 foreign key(sid) references acl_sid(id)
+);

acl/src/main/resources/createAclSchemaPostgres.sql

@@ -0,0 +1,46 @@
+-- ACL Schema SQL for PostgreSQL
+
+-- drop table acl_entry;
+-- drop table acl_object_identity;
+-- drop table acl_class;
+-- drop table acl_sid;
+
+create table acl_sid(
+    id bigserial not null primary key,
+    principal boolean not null,
+    sid varchar(100) not null,
+    constraint unique_uk_1 unique(sid,principal)
+);
+
+create table acl_class(
+    id bigserial not null primary key,
+    class varchar(100) not null,
+    constraint unique_uk_2 unique(class)
+);
+
+create table acl_object_identity(
+    id bigserial primary key,
+    object_id_class bigint not null,
+    object_id_identity bigint not null,
+    parent_object bigint,
+    owner_sid bigint,
+    entries_inheriting boolean not null,
+    constraint unique_uk_3 unique(object_id_class,object_id_identity),
+    constraint foreign_fk_1 foreign key(parent_object)references acl_object_identity(id),
+    constraint foreign_fk_2 foreign key(object_id_class)references acl_class(id),
+    constraint foreign_fk_3 foreign key(owner_sid)references acl_sid(id)
+);
+
+create table acl_entry(
+    id bigserial primary key,
+    acl_object_identity bigint not null,
+    ace_order int not null,
+    sid bigint not null,
+    mask integer not null,
+    granting boolean not null,
+    audit_success boolean not null,
+    audit_failure boolean not null,
+    constraint unique_uk_4 unique(acl_object_identity,ace_order),
+    constraint foreign_fk_4 foreign key(acl_object_identity) references acl_object_identity(id),
+    constraint foreign_fk_5 foreign key(sid) references acl_sid(id)
+);

acl/src/main/resources/jdbcMutableAclServiceTests-context.xml

@@ -1,70 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE beans PUBLIC "-//SPRING//DTD BEAN//EN" "http://www.springframework.org/dtd/spring-beans.dtd">
-
-<!--
-  - Application context containing business beans.
-  -
-  - Used by all artifacts.
-  -
-  - $Id:applicationContext-test.xml 1754 2006-11-17 02:01:21Z benalex $
-  -->
-
-<beans>
-    <bean id="transactionManager" class="org.springframework.jdbc.datasource.DataSourceTransactionManager">
-        <property name="dataSource" ref="dataSource"/>
-    </bean>
-
-    <bean id="aclCache" class="org.springframework.security.acls.jdbc.EhCacheBasedAclCache">
-        <constructor-arg>
-           <bean class="org.springframework.cache.ehcache.EhCacheFactoryBean">
-              <property name="cacheManager">
-                <bean class="org.springframework.cache.ehcache.EhCacheManagerFactoryBean"/>
-              </property>
-              <property name="cacheName" value="aclCache"/>
-           </bean>
-        </constructor-arg>
-    </bean>
-
-    <bean id="lookupStrategy" class="org.springframework.security.acls.jdbc.BasicLookupStrategy">
-        <constructor-arg ref="dataSource"/>
-        <constructor-arg ref="aclCache"/>
-        <constructor-arg ref="aclAuthorizationStrategy"/>
-        <constructor-arg>
-            <bean class="org.springframework.security.acls.domain.ConsoleAuditLogger"/>
-        </constructor-arg>
-    </bean>
-
-    <bean id="aclAuthorizationStrategy" class="org.springframework.security.acls.domain.AclAuthorizationStrategyImpl">
-        <constructor-arg>
-            <list>
-                <bean class="org.springframework.security.core.authority.GrantedAuthorityImpl">
-                    <constructor-arg value="ROLE_ADMINISTRATOR"/>
-                </bean>
-                <bean class="org.springframework.security.core.authority.GrantedAuthorityImpl">
-                    <constructor-arg value="ROLE_ADMINISTRATOR"/>
-                </bean>
-                <bean class="org.springframework.security.core.authority.GrantedAuthorityImpl">
-                    <constructor-arg value="ROLE_ADMINISTRATOR"/>
-                </bean>
-            </list>
-        </constructor-arg>
-    </bean>
-
-    <bean id="aclService" class="org.springframework.security.acls.jdbc.JdbcMutableAclService">
-        <constructor-arg ref="dataSource"/>
-        <constructor-arg ref="lookupStrategy"/>
-        <constructor-arg ref="aclCache"/>
-    </bean>
-
-    <bean id="dataSource" class="org.springframework.jdbc.datasource.DriverManagerDataSource">
-        <property name="driverClassName" value="org.hsqldb.jdbcDriver"/>
-        <property name="url" value="jdbc:hsqldb:mem:acltest"/>
-        <property name="username" value="sa"/>
-        <property name="password" value=""/>
-    </bean>
-
-    <bean id="jdbcTemplate" class="org.springframework.jdbc.core.JdbcTemplate">
-        <property name="dataSource" ref="dataSource"/>
-    </bean>
-
-</beans>

acl/src/main/resources/select.sql

@@ -1,27 +1,39 @@
 -- Not required. Just shows the sort of queries being sent to DB.
 
 
-select ACL_OBJECT_IDENTITY.OBJECT_ID_IDENTITY, ACL_ENTRY.ACE_ORDER, 
-ACL_OBJECT_IDENTITY.ID as ACL_ID,
-ACL_OBJECT_IDENTITY.PARENT_OBJECT,
-ACL_OBJECT_IDENTITY,ENTRIES_INHERITING,
-ACL_ENTRY.ID as ACE_ID, ACL_ENTRY.MASK, ACL_ENTRY.GRANTING, ACL_ENTRY.AUDIT_SUCCESS, ACL_ENTRY.AUDIT_FAILURE,
-ACL_SID.PRINCIPAL as ACE_PRINCIPAL, ACL_SID.SID as ACE_SID,
-ACLI_SID.PRINCIPAL as ACL_PRINCIPAL, ACLI_SID.SID as ACL_SID,
-ACL_CLASS.CLASS
+select  acl_object_identity.object_id_identity,
+        acl_entry.ace_order,
+        acl_object_identity.id as acl_id,
+        acl_object_identity.parent_object,
+        acl_object_identity,
+        entries_inheriting,
+        acl_entry.id as ace_id,
+        acl_entry.mask,
+        acl_entry.granting,
+        acl_entry.audit_success,
+        acl_entry.audit_failure,
+        acl_sid.principal as ace_principal,
+        acl_sid.sid as ace_sid,
+        acli_sid.principal as acl_principal,
+        acli_sid.sid as acl_sid,
+        acl_class.class
 
-from ACL_OBJECT_IDENTITY, ACL_SID ACLI_SID, ACL_CLASS
-LEFT JOIN ACL_ENTRY ON ACL_OBJECT_IDENTITY.ID = ACL_ENTRY.ACL_OBJECT_IDENTITY
-LEFT JOIN ACL_SID ON ACL_ENTRY.SID = ACL_SID.ID
+from    acl_object_identity,
+        acl_sid acli_sid,
+        acl_class
 
-where 
+left join acl_entry on acl_object_identity.id = acl_entry.acl_object_identity
+left join acl_sid on acl_entry.sid = acl_sid.id
+
+where
+    acli_sid.id = acl_object_identity.owner_sid
+
+and acl_class.id = acl_object_identity.object_id_class
 
-ACLI_SID.ID = ACL_OBJECT_IDENTITY.OWNER_SID
-and ACL_CLASS.ID = ACL_OBJECT_IDENTITY.OBJECT_ID_CLASS
 and (
-(ACL_OBJECT_IDENTITY.OBJECT_ID_IDENTITY = 1 
-and ACL_CLASS.CLASS = 'sample.contact.Contact')
-or 
-(ACL_OBJECT_IDENTITY.OBJECT_ID_IDENTITY = 2000
-and ACL_CLASS.CLASS = 'sample.contact.Contact')
-) order by ACL_OBJECT_IDENTITY.OBJECT_ID_IDENTITY asc, ACL_ENTRY.ACE_ORDER asc
+
+    (acl_object_identity.object_id_identity = 1 and acl_class.class = 'sample.contact.contact')
+or
+    (acl_object_identity.object_id_identity = 2000 and acl_class.class = 'sample.contact.contact')
+
+) order by acl_object_identity.object_id_identity asc, acl_entry.ace_order asc