title: Using Spring Security ACL with Spring Data REST
body: <p>I am trying to authorize apis exposed by Spring Data REST. So far I am able to do role-based authorization i.e:</p>
  
  <pre><code>@RepositoryRestResource(path = "book")
  public interface BookRepository extends JpaRepository&lt;Book, Long&gt; {
  
      @PreAuthorize("hasRole('ROLE_ADMIN')")
      &lt;S extends Book&gt; Book save(Book book);
  }
  </code></pre>
  
  <p>Also in the same project i have a service layer with ACL mechanism, which is working. </p>
  
  <p>I am unable to use PostFilter expression with Spring Data REST i.e:</p>
  
  <pre><code>@PostFilter("hasPermission(filterObject, 'read') or hasPermission(filterObject, admin)")
  List&lt;Book&gt; findAll();
  </code></pre>
  
  <p>It would be of great help, if anyone using ACL with Spring Data REST.</p>
  
  <p>Note: I am aware of below open issues:</p>
  
  <p><a href="https://jira.spring.io/browse/DATAREST-236">https://jira.spring.io/browse/DATAREST-236</a></p>
  
  <p><a href="https://jira.spring.io/browse/SEC-2409">https://jira.spring.io/browse/SEC-2409</a></p>