{"record":{"id":"e4c5dc9e781f413e","repo":"spring-projects/spring-security","slug":"unable-to-find-acl-information-for-object-identity","errorCode":null,"errorMessage":"Unable to find ACL information for object identity '{oid}'","messagePattern":"Unable to find ACL information for object identity '(.+?)'","errorType":"exception","errorClass":"NotFoundException","httpStatus":null,"severity":"error","filePath":"acl/src/main/java/org/springframework/security/acls/jdbc/JdbcAclService.java","lineNumber":145,"sourceCode":"\t@Override\n\tpublic Acl readAclById(ObjectIdentity object) throws NotFoundException {\n\t\treturn readAclById(object, null);\n\t}\n\n\t@Override\n\tpublic Map<ObjectIdentity, Acl> readAclsById(List<ObjectIdentity> objects) throws NotFoundException {\n\t\treturn readAclsById(objects, null);\n\t}\n\n\t@Override\n\tpublic Map<ObjectIdentity, Acl> readAclsById(List<ObjectIdentity> objects, @Nullable List<Sid> sids)\n\t\t\tthrows NotFoundException {\n\t\tMap<ObjectIdentity, Acl> result = this.lookupStrategy.readAclsById(objects, sids);\n\t\t// Check every requested object identity was found (throw NotFoundException if\n\t\t// needed)\n\t\tfor (ObjectIdentity oid : objects) {\n\t\t\tif (!result.containsKey(oid)) {\n\t\t\t\tthrow new NotFoundException(\"Unable to find ACL information for object identity '\" + oid + \"'\");\n\t\t\t}\n\t\t}\n\t\treturn result;\n\t}\n\n\t/**\n\t * Allows customization of the SQL query used to find child object identities.\n\t * @param findChildrenSql\n\t */\n\tpublic void setFindChildrenQuery(String findChildrenSql) {\n\t\tthis.findChildrenSql = findChildrenSql;\n\t}\n\n\tpublic void setAclClassIdSupported(boolean aclClassIdSupported) {\n\t\tthis.aclClassIdSupported = aclClassIdSupported;\n\t\tif (aclClassIdSupported) {\n\t\t\t// Change the default children select if it hasn't been overridden\n\t\t\tif (this.findChildrenSql.equals(DEFAULT_SELECT_ACL_WITH_PARENT_SQL)) {","sourceCodeStart":127,"sourceCodeEnd":163,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/acl/src/main/java/org/springframework/security/acls/jdbc/JdbcAclService.java#L127-L163","documentation":"JdbcAclService.readAclsById asks the LookupStrategy to load ACLs for the requested ObjectIdentity objects, then verifies every requested identity was found. If any identity is missing from the result map (no acl_object_identity row exists for it, or the SID filter excluded it), Spring Security throws NotFoundException. This is a data-presence check: the ACL database simply has no row for that object, or the query restricted results by SID and no matching entry was visible.","triggerScenarios":"Calling readAclsById(List<ObjectIdentity>, List<Sid>) (or via map) for an ObjectIdentity that was never persisted with JdbcMutableAclService.createAcl, or an identity whose ACL exists but has no entries visible to the supplied Sids.","commonSituations":"Checking permissions for a newly created domain object before createAcl was called; typo in object id or class name so the ObjectIdentity doesn't match the persisted row; reading ACLs with a Sid list that filters out all entries; database pointing at a different schema/environment than the one where the ACL was created.","solutions":["Persist the ACL first by calling JdbcMutableAclService.createAcl(objectIdentity) before reading it.","Verify the ObjectIdentity (type + identifier) exactly matches the row in acl_class/acl_object_identity, including id type.","Check you are connected to the database/schema where the ACL was actually created.","If filtering by Sids, confirm the ACL has at least one ACE or ownership visible to those Sids, or pass the sids the ACL was created with.","Catch org.springframework.security.acls.model.NotFoundException and treat the object as having no ACL (default-deny or lazy-create)."],"exampleFix":"// before\nMap<ObjectIdentity, Acl> acls = aclService.readAclsById(List.of(oid), sids);\n// after\nMutableAcl acl;\ntry {\n    acl = (MutableAcl) aclService.readAclsById(List.of(oid), sids).get(oid);\n} catch (NotFoundException ex) {\n    acl = mutableAclService.createAcl(oid); // lazily create missing ACL\n}","handlingStrategy":"try-catch","validationCode":"// verify ACL exists before reading\nLong pk = ((JdbcMutableAclService) aclService)\n    .createOrRetrieveClassPrimaryKey(type, true);\n// or simply:\nboolean exists = mutableAclService.retrieveObjectIdentityPrimaryKey(oid) != null;","typeGuard":"boolean hasAcl(ObjectIdentity oid) {\n    try { aclService.readAclsById(List.of(oid), sids); return true; }\n    catch (NotFoundException e) { return false; }\n}","tryCatchPattern":"try {\n    Map<ObjectIdentity, Acl> acls = aclService.readAclsById(objects, sids);\n} catch (NotFoundException e) {\n    // default-deny or lazy-create ACL for the missing identity\n}","preventionTips":["Always createAcl for new domain objects in the same transaction that saves them","Validate ObjectIdentity type/id against acl_object_identity before lookups","Pin datasource/schema per environment to avoid reading the wrong database"],"tags":["spring-security","acl","not-found","database"],"backgroundTag":"resource-not-found","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}