title: Problems with AccessReferenceMap
body: <p>I am using AccessReferenceMap from OWASP to secure my ids in URLs. The problem is that when list of IDs to be obfuscated is related to particular customer. Here is my configuration:</p>
  
  <pre><code>&lt;bean id="hyperlinkMapping" class="web.security.HyperlinkMapping" scope="session"&gt;
      &lt;aop:scoped-proxy /&gt;
  &lt;/bean&gt;
  
  &lt;bean id="tracksAccessMap" class="web.security.EntityAccessMap"
          scope="session" factory-method="create"&gt;
      &lt;constructor-arg index="0" ref="allTrackIdsForCustomer" /&gt;
      &lt;aop:scoped-proxy/&gt;
  &lt;/bean&gt;
  
  &lt;bean id="allTrackIdsForCustomer" scope="session"
      factory-bean="webTrackDAO"
      factory-method="findAllTrackIdsForCustomer"&gt;
      &lt;aop:scoped-proxy/&gt;
  &lt;/bean&gt;
  
  &lt;bean id="webTrackDAO" class="web.repository.impl.WebTrackDAOImpl"/&gt;
  </code></pre>
  
  <p>EntityAccessMap:</p>
  
  <pre><code>package web.security;
  
  import java.util.Iterator;
  import java.util.List;
  
  import org.apache.log4j.Logger;
  import org.owasp.esapi.AccessReferenceMap;
  import org.owasp.esapi.errors.AccessControlException;
  import org.owasp.esapi.reference.RandomAccessReferenceMap;
  import org.springframework.stereotype.Component;
  
  import core.domain.Entity;
  
  @Component
  public class EntityAccessMap&lt;T extends Entity&gt; implements AccessMap&lt;T&gt; {
      private static Logger logger = Logger.getLogger(EntityAccessMap.class);
  
      private static final long serialVersionUID = -436098952674898327L;
      private AccessReferenceMap&lt;String&gt; map = new RandomAccessReferenceMap();
  
      public EntityAccessMap() {
      }
  
      private EntityAccessMap(final List&lt;T&gt; entities) {
          logger.info("Entities size: " + entities.size());
          for (final T entity : entities) {
              map.addDirectReference(entity);
          }
      }
  
      public &lt;T extends Entity&gt; AccessMap&lt;T&gt; create(final List&lt;T&gt; entities) {
          logger.info("calling create with entities' size " + entities.size() );
          return new EntityAccessMap&lt;&gt;(entities);
      }
  
      public String getIndirectReference(final T entity) {
          for( Iterator it = map.iterator(); it.hasNext(); ) {
              logger.info((String)it.next().toString());
          }
          logger.info("Entity: " + map.getIndirectReference(entity));
          return map.getIndirectReference(entity);
      }
  
      public T getDirectReference(final String indirectReference) {
          try {
              return map.getDirectReference(indirectReference);
          } catch (AccessControlException e) {
              throw new IllegalArgumentException("Indirect Reference is not valid", e);
          }
      }
  }
  </code></pre>
  
  <p>AccessMap:</p>
  
  <pre><code>package web.security;
  
  import java.io.Serializable;
  
  import core.domain.Entity;
  
  public interface AccessMap&lt;T extends Entity&gt; extends Serializable {
      String getIndirectReference(final T entity);
      T getDirectReference(final String indirectReference);
  }
  </code></pre>
  
  <p>HyperlinkMapping:</p>
  
  <pre><code>package web.security;
  
  import java.io.Serializable;
  
  import org.springframework.beans.factory.annotation.Autowired;
  
  import core.domain.track.Track;
  
  public class HyperlinkMapping implements Serializable {
      private static final long serialVersionUID = -2011016815710653498L;
  
      @Autowired AccessMap&lt;Track&gt; tracksAccessMap;
  
      public String getTrackId(final Track track) {
          return tracksAccessMap.getIndirectReference(track);
      }
  
      public Track getTrack(final String indirectId) {
          return tracksAccessMap.getDirectReference(indirectId);
      }
  }
  </code></pre>
  
  <p>So, what I want to achieve: tracksAccessMap should be filled only with customer's related ids, not whole set. How to initialize all these beans after customer's login (and setting customerId session attribute)?</p>
  
  <p><strong>EDIT 1</strong>: additional code:</p>
  
  <p>TracksController:</p>
  
  <pre><code>package web.controller;
  
  import javax.servlet.http.HttpServletRequest;
  
  import org.springframework.beans.factory.annotation.Autowired;
  import org.springframework.context.annotation.Scope;
  import org.springframework.security.access.annotation.Secured;
  import org.springframework.stereotype.Controller;
  import org.springframework.web.bind.annotation.RequestMapping;
  import org.springframework.web.bind.annotation.RequestMethod;
  import org.springframework.web.bind.annotation.RequestParam;
  import org.springframework.web.servlet.ModelAndView;
  
  import core.constants.WebConstants;
  import web.service.TrackService;
  
  @Controller
  @Secured("ROLE_USER")
  @RequestMapping(WebConstants.WEB_MY)
  @Scope("session")
  public class TracksController {
  
      @Autowired
      private TrackService trackService;
      @Autowired
      private HyperlinkMapping hyperlinkMapping;
  
      @RequestMapping(value=WebConstants.WEB_MYTRACKS, method = RequestMethod.GET, produces = "application/json")
      public ModelAndView showTracks( HttpServletRequest  request, @RequestParam(value = "pageSize", required = false) Integer pageSize ) {
          ModelAndView mv = new ModelAndView();
          mv.addObject("pagedListHolder",trackService.getTracksList(request, pageSize == null ? 10 : pageSize ));
          mv.addObject("hyperlinkMapping",hyperlinkMapping);
          return mv;
      }
  }
  </code></pre>
  
  <p>centerColTracks.jsp</p>
  
  <pre><code>&lt;c:forEach items="${pagedListHolder.pageList}" var="item"&gt;
      &lt;tr&gt;
          &lt;td&gt;${item.id}&lt;/td&gt;
          &lt;td style="color:blue;text-align:right"&gt;&lt;a href="&lt;c:url value="${request.getRequestURL()}/my/tracks/${hyperlinkMapping.getTrackId(item)}"/&gt;"&gt;${item.name}&lt;/a&gt;&lt;/td&gt;
          &lt;td style="color:blue;text-align:right"&gt;${item.trackDate}&lt;/td&gt;
          &lt;td style="color:blue;text-align:right"&gt;${item.description}&lt;/td&gt;
      &lt;/tr&gt;
  &lt;/c:forEach&gt;
  </code></pre>
  
  <p>hyperlinkMapping.getTrackId(item) should return ONLY trackId (taken from AccessReferenceMap) related ONLY for customer logged in. In other words - hyperlinkMapping should be instantiated right after the login. </p>
  
  <p>I have two ideas how to do this: 1. AOP with after-returning advice, or 2. use SimpleUrlAuthenticationSuccessHandler, where I can instantiate HyperlinkMapping after login. Or I can use it with the current implementation and I just simply forgot something?</p>