After defining the domain classes, we also want some DAOs to persist and delete ACLs.

package org.appfuse.dao;
 
import org.appfuse.model.acl.BasicAclObjectIdentity;
 
public interface BasicAclObjectIdentityDao extends GenericDao<BasicAclObjectIdentity, Long> {
 
	/**
	 * Saves a object identity to persistent storage
	 * 
	 * @param basicAclObjectIdentity Identity to save
	 */
	public void saveBasicAclObjectIdentity(BasicAclObjectIdentity basicAclObjectIdentity);
 
	/**
	 * Removes an object identity from persistent storage
	 * 
	 * @param id ID of hte identity to remove
	 */
	public void deleteBasicAclObjectIdentity(Long id);
 
	/**
	 * Loads an object identity with the given id from persistent
	 * storage
	 * 
	 * @param id ID of the identity to load
	 * @return An object identity with the given id
	 */
	public BasicAclObjectIdentity getBasicAclObjectIdentity(Long id);
 
	/**
	 * Loads an object identity by a string representing the Object (e.g.
	 * CLASSNAME:PRIMARY_KEY)
	 * 
	 * @param obejctIdentity The identity (e.g. CLASSNAME:PRIMARY_KEY) of the object
	 * @return An object identity
	 */
	public BasicAclObjectIdentity getBasicAclObjectIdentity(String obejctIdentity);
}

package org.appfuse.dao;
 
import java.util.List;
import java.util.Set;
 
import org.acegisecurity.Authentication;
import org.acegisecurity.GrantedAuthority;
import org.acegisecurity.acl.basic.BasicAclDao;
import org.appfuse.model.acl.BasicAclPermission;
 
public interface BasicAclPermissionDao extends GenericDao<BasicAclPermission, Long>, BasicAclDao {
 
	/**
	 * Saves a permission to the persistent storage
	 * 
	 * @param basicACLPermission Permission to save
	 */
	public void saveBasicAclPermission(BasicAclPermission basicACLPermission);
 
	/**
	 * Loads a permission from persistent storage by id
	 * 
	 * @param id ID of the permission to load
	 * @return A permission with the id id
	 */
	public BasicAclPermission getBasicAclPermission(Long id);
 
	/**
	 * Removes a permission by the id
	 * @param id Id of the permission to delete
	 */
	public void deleteBasicAclPermission(Long id);
 
	/**
	 * Loads all permissions an user represented by the authentication
	 * has on an object represented by the objectIdentity
	 *  
	 * @param objectIdentity String representing an unique instance of a class
	 * @param auth Authentication represetning the user
	 * @return List of permissions a user has on a specific object
	 */
	public Set<BasicAclPermission> getBasicAclPermissions(String objectIdentity, Authentication auth);
 
	/**
	 * Returns a list of permissions an user (and only the user) with the username
	 * username has on an object represented by the objectIdentity
	 * 
	 * @param objectIdentity String representing an unique instance of a class
	 * @param username Username of the user
	 * @return List of permissions a user has directly on an object
	 */
	public List<BasicAclPermission> getBasicAclPermissions(String objectIdentity, String username);
 
	/**
	 * Returns a list of permissions the Authorities have on an object represented by
	 * the objectIdentity
	 * 
	 * @param objectIdentity String representing an unique instance of a class
	 * @param authorities Array of authorities
	 * @return List of permissions
	 */
	public List<BasicAclPermission> getBasicAclPermissions(String objectIdentity, GrantedAuthority[] authorities);
 
	/**
	 * Returns all Permissions granted on an object represented by objectIdentity
	 * 
	 * @param objectIdentity String representing an unique instance of a class
	 * @return All Permissions granted on an object represented by objectIdentity
	 */
	public List<BasicAclPermission> getBasicAclPermissions(String objectIdentity);
 
	/**
	 * Returns all permissions granted for an user with the username username
	 * 
	 * @param username Username of the user 
	 * @return List of permissions
	 */
	public List<BasicAclPermission> getBasicAclPermissionsByUsername(String username);
 
}

package org.appfuse.dao.hibernate;
 
import org.appfuse.dao.BasicAclObjectIdentityDao;
import org.appfuse.dao.hibernate.GenericDaoHibernate;
import org.appfuse.model.acl.BasicAclObjectIdentity;
import org.hibernate.Hibernate;
import org.hibernate.Query;
import org.springframework.orm.ObjectRetrievalFailureException;
 
public class BasicAclObjectIdentityDaoHibernate extends
		GenericDaoHibernate<BasicAclObjectIdentity, Long> implements
		BasicAclObjectIdentityDao {
 
	public BasicAclObjectIdentityDaoHibernate() {
		super(BasicAclObjectIdentity.class);
	}
 
	/* (non-Javadoc)
	 * @see org.appfuse.dao.BasicAclObjectIdentityDao#saveBasicAclObjectIdentity(org.appfuse.model.acl.BasicAclObjectIdentity)
	 */
	public void saveBasicAclObjectIdentity(
			BasicAclObjectIdentity basicAclObjectIdentity) {
		getHibernateTemplate().saveOrUpdate(basicAclObjectIdentity);
	}
 
	/* (non-Javadoc)
	 * @see org.appfuse.dao.BasicAclObjectIdentityDao#deleteBasicAclObjectIdentity(java.lang.Long)
	 */
	public void deleteBasicAclObjectIdentity(Long id) {
		getHibernateTemplate().delete(getBasicAclObjectIdentity(id));
	}
 
	/* (non-Javadoc)
	 * @see org.appfuse.dao.BasicAclObjectIdentityDao#getBasicAclObjectIdentity(java.lang.Long)
	 */
	public BasicAclObjectIdentity getBasicAclObjectIdentity(Long id) {
		BasicAclObjectIdentity basicAclObjectIdentity =
			(BasicAclObjectIdentity) getHibernateTemplate().get(BasicAclObjectIdentity.class, id);
 
		if (basicAclObjectIdentity == null) {
			log.warn("Uh oh, BasicAclObjectIdentity with id ['" + id + "'] not found...");
			throw new ObjectRetrievalFailureException(BasicAclObjectIdentity.class, id);
		}
 
		return basicAclObjectIdentity;
	}
 
	/* (non-Javadoc)
	 * @see org.appfuse.dao.BasicAclObjectIdentityDao#getBasicAclObjectIdentity(java.lang.String)
	 */
	public BasicAclObjectIdentity getBasicAclObjectIdentity(String objectIdentity) {
		Query query = getSessionFactory().getCurrentSession().createQuery(
			"select acl from BasicAclObjectIdentity as acl where acl.objectIdentity = :identity");
		query.setParameter("identity", objectIdentity, Hibernate.STRING);
 
		Object result = query.uniqueResult();
 
		if (result == null) {
			throw new ObjectRetrievalFailureException(BasicAclObjectIdentity.class, objectIdentity);
		}
 
		return (BasicAclObjectIdentity) result;
	}
}

package org.appfuse.dao.hibernate;
 
import java.util.ArrayList;
import java.util.HashSet;
import java.util.List;
import java.util.Set;
 
import org.acegisecurity.Authentication;
import org.acegisecurity.GrantedAuthority;
import org.acegisecurity.acl.basic.AclObjectIdentity;
import org.acegisecurity.acl.basic.BasicAclEntry;
import org.acegisecurity.userdetails.UserDetails;
import org.appfuse.dao.BasicAclPermissionDao;
import org.appfuse.model.acl.BasicAclObjectIdentity;
import org.appfuse.model.acl.BasicAclPermission;
import org.hibernate.Hibernate;
import org.hibernate.Query;
 
public class BasicAclPermissionDaoHibernate extends GenericDaoHibernate<BasicAclPermission, Long>
		implements BasicAclPermissionDao {
 
 
	public BasicAclPermissionDaoHibernate() {
		super(BasicAclPermission.class);
	}
 
	/* (non-Javadoc)
	 * @see org.appfuse.dao.BasicAclPermissionDao#saveBasicAclPermission(org.appfuse.model.acl.BasicAclPermission)
	 */
	public void saveBasicAclPermission(BasicAclPermission basicACLPermission) {
		getHibernateTemplate().saveOrUpdate(basicACLPermission);
	}
 
	/* (non-Javadoc)
	 * @see org.appfuse.dao.BasicAclPermissionDao#getBasicAclPermission(java.lang.Long)
	 */
	public BasicAclPermission getBasicAclPermission(Long id) {
		return (BasicAclPermission) getHibernateTemplate().get(
				BasicAclPermission.class, id);
	}
 
	/* (non-Javadoc)
	 * @see org.appfuse.dao.BasicAclPermissionDao#deleteBasicAclPermission(java.lang.Long)
	 */
	public void deleteBasicAclPermission(Long id) {
		getHibernateTemplate().delete(getBasicAclPermission(id));
	}
 
	/* (non-Javadoc)
	 * @see org.appfuse.dao.BasicAclPermissionDao#getBasicAclPermissions(java.lang.String, org.acegisecurity.Authentication)
	 */
	public Set<BasicAclPermission> getBasicAclPermissions(String objectIdentity, Authentication auth) {
		Set<BasicAclPermission> toReturn = new HashSet<BasicAclPermission>();
		String username = "";
		if (auth.getPrincipal() instanceof String) {
			username = (String) auth.getPrincipal();
		} else if (auth.getPrincipal() instanceof UserDetails) {
			username = ((UserDetails) auth.getPrincipal()).getUsername();
		}
 
		List<BasicAclPermission> userpermissions = getBasicAclPermissions(objectIdentity, username);
		toReturn.addAll(userpermissions);
		List<BasicAclPermission> authorityPermissions = getBasicAclPermissions(objectIdentity, auth.getAuthorities());
		toReturn.addAll(authorityPermissions);
 
		if (log.isDebugEnabled()) {
			log.debug("Found [ " + toReturn.size() + "] permissions for auth [" + auth +  "]");
		}
		return toReturn;
	}
 
	/* (non-Javadoc)
	 * @see org.appfuse.dao.BasicAclPermissionDao#getBasicAclPermissions(java.lang.String, java.lang.String)
	 */
	@SuppressWarnings("unchecked")
	public List<BasicAclPermission> getBasicAclPermissions(String objectIdentity, String username) {
		String queryString = "from BasicAclPermission as p WHERE p.basicAclObjectIdentity.objectIdentity = :identity " +
				" AND p.objRecipient = :username";
 
		Query query = getSessionFactory().getCurrentSession().createQuery(queryString);
		query.setParameter("identity", objectIdentity, Hibernate.STRING);
		query.setParameter("username", username, Hibernate.STRING);
 
		List<BasicAclPermission> usernameResults = query.list();
		return usernameResults;
	}
 
	/* (non-Javadoc)
	 * @see org.appfuse.dao.BasicAclPermissionDao#getBasicAclPermissions(java.lang.String, org.acegisecurity.GrantedAuthority[])
	 */
	@SuppressWarnings("unchecked")
	public List<BasicAclPermission> getBasicAclPermissions(String objectIdentity, GrantedAuthority[] authorities) {
 
		// no authorities? -> no need to query
		if (authorities.length < 1) {
			return new ArrayList<BasicAclPermission>();
		}
 
		// construct role parameters for one single query, to lower the performance
		// impact in environments with many roles per user
		StringBuffer sb = new StringBuffer(50);
		for (int i = 0; i < authorities.length; i++) {
			sb.append(":rolename");
			sb.append(i);
			sb.append(", ");
		}
		sb.setLength(sb.length() - 2);
 
		String queryString = "from BasicAclPermission as p WHERE p.basicAclObjectIdentity.objectIdentity = :identity " +
				" AND p.objRecipient in (" + sb.toString() + ")";
 
		Query query = getSessionFactory().getCurrentSession().createQuery(queryString);
		query.setParameter("identity", objectIdentity, Hibernate.STRING);
		for (int i = 0; i < authorities.length; i++) {
			query.setParameter("rolename" + i, authorities[i].getAuthority(), Hibernate.STRING);
		}
		List<BasicAclPermission> toReturn = query.list();
		return toReturn;
	}
 
	/* (non-Javadoc)
	 * @see org.appfuse.dao.BasicAclPermissionDao#getBasicAclPermissions(java.lang.String)
	 */
	@SuppressWarnings("unchecked")
	public List<BasicAclPermission> getBasicAclPermissions(String objectIdentity) {
		String queryString = "from BasicAclPermission as p where p.basicAclObjectIdentity.objectIdentity = :identity";
		Query query = getSessionFactory().getCurrentSession().createQuery(queryString);
		query.setParameter("identity", objectIdentity, Hibernate.STRING);
		List<BasicAclPermission> results = query.list();
		return results;
	}
 
	/* (non-Javadoc)
	 * @see org.appfuse.dao.BasicAclPermissionDao#getBasicAclPermissionsByUsername(java.lang.String)
	 */
	@SuppressWarnings("unchecked")
	public List<BasicAclPermission> getBasicAclPermissionsByUsername(String username) {
		String queryString = "select permission from BasicAclPermission as permission where permission.objRecipient = :username";
		Query query = getSessionFactory().getCurrentSession().createQuery(queryString);
		query.setParameter("username", username, Hibernate.STRING);
		List<BasicAclPermission> results = query.list();
		if (log.isDebugEnabled()) {
			log.debug("Found [" + results.size() + "] BasicACLPermissions for user [" + username + "]");
		}
		return results;
	}
 
	/* (non-Javadoc)
	 * @see org.acegisecurity.acl.basic.BasicAclDao#getAcls(org.acegisecurity.acl.basic.AclObjectIdentity)
	 */
	public BasicAclEntry[] getAcls(AclObjectIdentity aclObjectIdentity) {
		if (aclObjectIdentity instanceof BasicAclObjectIdentity) {
			BasicAclObjectIdentity oid = (BasicAclObjectIdentity) aclObjectIdentity;
			List<BasicAclPermission> entries = getBasicAclPermissions(oid.toString());
			return (BasicAclEntry[]) entries.toArray(new BasicAclEntry[] {});
		}
		return null;
	}
}

For being able to use the DAOs, they have to be defined in applicationContext.xml:

<bean id="basicAclObjectIdentityDao" class="org.appfuse.dao.hibernate.BasicAclObjectIdentityDaoHibernate">
    <property name="sessionFactory" ref="sessionFactory"/>
</bean>
 
<bean id="basicAclPermissionDao" class="org.appfuse.dao.hibernate.BasicAclPermissionDaoHibernate">
    <property name="sessionFactory" ref="sessionFactory"/>
</bean>