spring-projects/spring-security · error · AccessDeniedException

Principal does not have required ACL permissions to perform

Error message

Principal does not have required ACL permissions to perform requested operation

What it means

AclAuthorizationStrategyImpl.securityCheck() throws AccessDeniedException when the authenticated principal is neither the ACL owner, nor holds the required administrative GrantedAuthority, nor is granted BasePermission.ADMINISTRATION via the ACL's ACEs. This is the final gate before ACL changes are applied.

Source

Thrown at acl/src/main/java/org/springframework/security/acls/domain/AclAuthorizationStrategyImpl.java:130

		if (owner instanceof GrantedAuthoritySid
				&& authorities.contains(((GrantedAuthoritySid) owner).getGrantedAuthority())) {
			return;
		}

		// Not authorized by ACL ownership; try via adminstrative permissions
		GrantedAuthority requiredAuthority = getRequiredAuthority(changeType);

		if (authorities.contains(requiredAuthority.getAuthority())) {
			return;
		}

		// Try to get permission via ACEs within the ACL
		List<Sid> sids = this.sidRetrievalStrategy.getSids(authentication);
		if (acl.isGranted(Arrays.asList(BasePermission.ADMINISTRATION), sids, false)) {
			return;
		}

		throw new AccessDeniedException(
				"Principal does not have required ACL permissions to perform requested operation");
	}

	private GrantedAuthority getRequiredAuthority(int changeType) {
		if (changeType == CHANGE_AUDITING) {
			return this.gaModifyAuditing;
		}
		if (changeType == CHANGE_GENERAL) {
			return this.gaGeneralChanges;
		}
		if (changeType == CHANGE_OWNERSHIP) {
			return this.gaTakeOwnership;
		}
		throw new IllegalArgumentException("Unknown change type");
	}

	/**
	 * Creates a principal-like sid from the authentication information.

View on GitHub (pinned to 96852e8860)

Solutions

1. Grant the principal BasePermission.ADMINISTRATION on the ACL, or make them the owner (acl.setOwner(sid) then updateAcl)
2. Configure AclAuthorizationStrategyImpl with the right authorities and grant users the needed one (e.g. ROLE_ACL_ADMIN for CHANGE_GENERAL)
3. Have an owner/admin perform the ACL mutation instead
4. Check acl.isGranted path and SID resolution if the principal believes they hold ADMINISTRATION

Example fix

// before
new AclAuthorizationStrategyImpl(
    new SimpleGrantedAuthority("ROLE_ADMIN"),
    new SimpleGrantedAuthority("ROLE_ADMIN"),
    new SimpleGrantedAuthority("ROLE_ADMIN"));
// users lack ROLE_ADMIN

// after
new AclAuthorizationStrategyImpl(
    new SimpleGrantedAuthority("ROLE_ACL_OWNER"),
    new SimpleGrantedAuthority("ROLE_ACL_AUDIT"),
    new SimpleGrantedAuthority("ROLE_ACL_ADMIN"));
// and grant ROLE_ACL_ADMIN to service accounts that modify ACLs

Acl acl = aclService.readAclById(objectIdentity);
boolean canAdminister = acl.isGranted(List.of(BasePermission.ADMINISTRATION),
    sidRetrievalStrategy.getSids(authentication), false)
    || authentication.getAuthorities().stream()
        .anyMatch(g -> g.getAuthority().equals("ROLE_ACL_ADMIN"));

null

try {
    mutableAclService.updateAcl(acl);
} catch (AccessDeniedException e) {
    throw new ResponseStatusException(HttpStatus.FORBIDDEN, "Not an ACL administrator");
}

When it happens

Trigger: A non-owner principal without the required change-type authority (e.g. aclAuthorizationStrategy with CHANGE_GENERAL authority not assigned) attempts setOwner/setEntriesInheriting/insertAce/deleteAcl and acl.isGranted(ADMINISTRATION, sids, false) returns false.

Common situations: Regular users editing ACLs they can read but not administer; missing gaModifyAccessControl/gaModifyAuditing/gaTakeOwnership authorities in AclAuthorizationStrategyImpl construction; ownership never transferred after object creation by an admin.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

• AclEntryAfterInvocationProvider.noPermission
• Authenticated principal required to operate with ACLs
• Access is denied
• Access is denied
• Access is denied

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/1da6f25bcd40fa97. Report an issue: GitHub.