{"record":{"id":"178f777ee2e1cd70","repo":"spring-projects/spring-security","slug":"aclentryafterinvocationprovider-nopermission","errorCode":"AclEntryAfterInvocationProvider.noPermission","errorMessage":"Authentication {0} has NO permissions to the domain object {1}","messagePattern":"Authentication (.+?) has NO permissions to the domain object (.+?)","errorType":"exception","errorClass":"AccessDeniedException","httpStatus":403,"severity":"error","filePath":"acl/src/main/java/org/springframework/security/acls/afterinvocation/AclEntryAfterInvocationProvider.java","lineNumber":111,"sourceCode":"\t\tfor (ConfigAttribute attr : config) {\n\t\t\tif (!this.supports(attr)) {\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\t// Need to make an access decision on this invocation\n\t\t\tif (hasPermission(authentication, returnedObject)) {\n\t\t\t\treturn returnedObject;\n\t\t\t}\n\n\t\t\tlogger.debug(\"Denying access\");\n\t\t\tthrow new AccessDeniedException(this.messages.getMessage(\"AclEntryAfterInvocationProvider.noPermission\",\n\t\t\t\t\tnew Object[] { authentication.getName(), returnedObject },\n\t\t\t\t\t\"Authentication {0} has NO permissions to the domain object {1}\"));\n\t\t}\n\n\t\treturn returnedObject;","sourceCodeStart":null,"sourceCodeEnd":null,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/acl/src/main/java/org/springframework/security/acls/afterinvocation/AclEntryAfterInvocationProvider.java#L111","documentation":"AclEntryAfterInvocationProvider filters or authorizes a method's returned domain object against the ACL system. When the current Authentication holds none of the required permissions (configured via requirePermission entries) on the object's ACL, it throws AccessDeniedException with message code 'AclEntryAfterInvocationProvider.noPermission'.","triggerScenarios":"afterInvocation runs on a returned domain object (or collection) and acl.isGranted() for the caller's SIDs against the configured requirePermission list (e.g. BasePermission.READ) returns false; also triggered if the ACL has no ACEs at all for the principal.","commonSituations":"Object exists but was never inserted into the ACL tables; SIDs not resolving to the caller's groups; ACL lookup using a different ObjectIdentity than the one with granted ACEs; forgetting to grant READ to the role owning the object.","solutions":["Insert an ACE granting the principal (or its granted authority) the required permission: acl.insertAce(relevantOrder, BasePermission.READ, sid, true)","Verify the AclService can resolve the ObjectIdentity of the returned object (mutableAclService.createObjectIdentity if missing)","Check SidRetrievalStrategy returns the expected SIDs (user + authorities)","Confirm requirePermission list matches the permissions actually granted"],"exampleFix":"// before\n// object has no ACEs for current user\nMutableAcl acl = (MutableAcl) mutableAclService.readAclById(oid);\n\n// after\nMutableAcl acl = (MutableAcl) mutableAclService.readAclById(oid);\nacl.insertAce(acl.getEntries().size(), BasePermission.READ,\n    new PrincipalSid(authentication), true);\nmutableAclService.updateAcl(acl);","handlingStrategy":"try-catch","validationCode":"Acl acl = aclService.readAclById(objectIdentity);\nboolean allowed = acl.isGranted(List.of(BasePermission.READ),\n    sidRetrievalStrategy.getSids(authentication), false);","typeGuard":"null","tryCatchPattern":"try {\n    Object result = securedService.readDomainObject(id);\n} catch (AccessDeniedException e) {\n    throw new ResponseStatusException(HttpStatus.FORBIDDEN, \"No ACL permission on object\");\n}","preventionTips":["Provision ACLs (with READ ACEs) whenever domain objects are created","Verify ObjectIdentity registration for every ACL-secured type","Test SID resolution (user + group authorities) for representative users"],"tags":["spring-security","acl","after-invocation","access-denied","permissions"],"backgroundTag":"insufficient-permissions","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}