title: How to get a List of Objects that a user can access using ACLs related tables
body: <p>I'm designing a system that has a lot of requirements around user management/permissions, so I decided to use Spring Security ACL to manage the permissions at the Domain Objects level. </p>
  
  <p>Although, using ACLs to maintain the relations between Users and Entities force us to rely on that to present the data on the UI.</p>
  
  <p>The PostFilter solution that is provided by Spring Security does a good job filtering the objects that a User can/cannot see but it has a big performance issue when we're dealing with an entity that has hundreds/thousands of entries, because we need to load everything from the database and then discard the objects that user isn't allowed to "see".</p>
  
  <p>That problem is described here - <a href="https://jira.spring.io/browse/SEC-2409" rel="noreferrer">SEC-2409</a> - but it'll take some time until the feature is available. So, I'm trying to find a workaround to use Spring Security ACL but avoid the performance issue. </p>
  
  <p>I thought about implementing some code to retrieve the Objects that a User can access (after the authentication process) and keep that information available to be used on every request to allow the developers to use that info to perform the queries and not relying on the PostFilter.</p>
  
  <p>In order to implement that, I'm trying to find a way to retrieve the list of permissions for a given principal/granted authority but I'm not able to find a way to do that with the available AclService implementations. </p>
  
  <p><strong>Example</strong>: <code>aclService.getObjectIdentityList(&lt;sid&gt;,&lt;acl_class&gt;)</code></p>
  
  <p><strong>Note:</strong> The method should use the inheritance structure and include all the ObjectIdentities that are inherited from a parent entry</p>
  
  <p>Any suggestion to get the data or another approach to solve this problem?</p>
  
  <hr>
  
  <p><strong>UPDATE</strong></p>
  
  <p>I already found a way to retrieve the List of objects that a User can access.</p>
  
  <pre><code>List&lt;ObjectIdentity&gt; childObjects = aclService.findChildren(objectIdentity);
  Map&lt;ObjectIdentity, Acl&gt; result = aclService.readAclsById(childObjects, sids);
  </code></pre>
  
  <p>And this approach work for us, because we just have a few entities which the access is controlled by ACLs, so we can construct the list of ObjectsIdentities that a User has access. </p>
  
  <p>Although, the Map that is being return, is returning all the ACLs for the ObjectIdentities that are being passed and then I need to check the if the user has access to each ObjectIdentity that is being returned.</p>
  
  <p>Do you have an easy way to do this or to simplify all of this logic?</p>