spring-projects/spring-security · error · NotFoundException

Unable to find ACL information for object identity '{oid}'

Error message

Unable to find ACL information for object identity '{oid}'

What it means

JdbcAclService.readAclsById asks the LookupStrategy to load ACLs for the requested ObjectIdentity objects, then verifies every requested identity was found. If any identity is missing from the result map (no acl_object_identity row exists for it, or the SID filter excluded it), Spring Security throws NotFoundException. This is a data-presence check: the ACL database simply has no row for that object, or the query restricted results by SID and no matching entry was visible.

Source

Thrown at acl/src/main/java/org/springframework/security/acls/jdbc/JdbcAclService.java:145

	@Override
	public Acl readAclById(ObjectIdentity object) throws NotFoundException {
		return readAclById(object, null);
	}

	@Override
	public Map<ObjectIdentity, Acl> readAclsById(List<ObjectIdentity> objects) throws NotFoundException {
		return readAclsById(objects, null);
	}

	@Override
	public Map<ObjectIdentity, Acl> readAclsById(List<ObjectIdentity> objects, @Nullable List<Sid> sids)
			throws NotFoundException {
		Map<ObjectIdentity, Acl> result = this.lookupStrategy.readAclsById(objects, sids);
		// Check every requested object identity was found (throw NotFoundException if
		// needed)
		for (ObjectIdentity oid : objects) {
			if (!result.containsKey(oid)) {
				throw new NotFoundException("Unable to find ACL information for object identity '" + oid + "'");
			}
		}
		return result;
	}

	/**
	 * Allows customization of the SQL query used to find child object identities.
	 * @param findChildrenSql
	 */
	public void setFindChildrenQuery(String findChildrenSql) {
		this.findChildrenSql = findChildrenSql;
	}

	public void setAclClassIdSupported(boolean aclClassIdSupported) {
		this.aclClassIdSupported = aclClassIdSupported;
		if (aclClassIdSupported) {
			// Change the default children select if it hasn't been overridden
			if (this.findChildrenSql.equals(DEFAULT_SELECT_ACL_WITH_PARENT_SQL)) {

View on GitHub (pinned to 96852e8860)

Solutions

  1. Persist the ACL first by calling JdbcMutableAclService.createAcl(objectIdentity) before reading it.
  2. Verify the ObjectIdentity (type + identifier) exactly matches the row in acl_class/acl_object_identity, including id type.
  3. Check you are connected to the database/schema where the ACL was actually created.
  4. If filtering by Sids, confirm the ACL has at least one ACE or ownership visible to those Sids, or pass the sids the ACL was created with.
  5. Catch org.springframework.security.acls.model.NotFoundException and treat the object as having no ACL (default-deny or lazy-create).

Example fix

// before
Map<ObjectIdentity, Acl> acls = aclService.readAclsById(List.of(oid), sids);
// after
MutableAcl acl;
try {
    acl = (MutableAcl) aclService.readAclsById(List.of(oid), sids).get(oid);
} catch (NotFoundException ex) {
    acl = mutableAclService.createAcl(oid); // lazily create missing ACL
}
Defensive patterns

Strategy: try-catch

Validate before calling

// verify ACL exists before reading
Long pk = ((JdbcMutableAclService) aclService)
    .createOrRetrieveClassPrimaryKey(type, true);
// or simply:
boolean exists = mutableAclService.retrieveObjectIdentityPrimaryKey(oid) != null;

Type guard

boolean hasAcl(ObjectIdentity oid) {
    try { aclService.readAclsById(List.of(oid), sids); return true; }
    catch (NotFoundException e) { return false; }
}

Try / catch

try {
    Map<ObjectIdentity, Acl> acls = aclService.readAclsById(objects, sids);
} catch (NotFoundException e) {
    // default-deny or lazy-create ACL for the missing identity
}

Prevention

When it happens

Trigger: Calling readAclsById(List<ObjectIdentity>, List<Sid>) (or via map) for an ObjectIdentity that was never persisted with JdbcMutableAclService.createAcl, or an identity whose ACL exists but has no entries visible to the supplied Sids.

Common situations: Checking permissions for a newly created domain object before createAcl was called; typo in object id or class name so the ObjectIdentity doesn't match the persisted row; reading ACLs with a Sid list that filters out all entries; database pointing at a different schema/environment than the one where the ACL was created.

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/e4c5dc9e781f413e. Report an issue: GitHub.