{"action":"created","issue":{"url":"https://api.github.com/repos/strongloop/loopback/issues/2222","repository_url":"https://api.github.com/repos/strongloop/loopback","labels_url":"https://api.github.com/repos/strongloop/loopback/issues/2222/labels{/name}","comments_url":"https://api.github.com/repos/strongloop/loopback/issues/2222/comments","events_url":"https://api.github.com/repos/strongloop/loopback/issues/2222/events","html_url":"https://github.com/strongloop/loopback/issues/2222","id":147942283,"number":2222,"title":"ACL DENY all properties for everyone","user":{"login":"sbehrends","id":327827,"avatar_url":"https://avatars.githubusercontent.com/u/327827?v=3","gravatar_id":"","url":"https://api.github.com/users/sbehrends","html_url":"https://github.com/sbehrends","followers_url":"https://api.github.com/users/sbehrends/followers","following_url":"https://api.github.com/users/sbehrends/following{/other_user}","gists_url":"https://api.github.com/users/sbehrends/gists{/gist_id}","starred_url":"https://api.github.com/users/sbehrends/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sbehrends/subscriptions","organizations_url":"https://api.github.com/users/sbehrends/orgs","repos_url":"https://api.github.com/users/sbehrends/repos","events_url":"https://api.github.com/users/sbehrends/events{/privacy}","received_events_url":"https://api.github.com/users/sbehrends/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/strongloop/loopback/labels/triage","name":"triage","color":"eb6420"}],"state":"open","locked":false,"assignee":{"login":"gunjpan","id":14811089,"avatar_url":"https://avatars.githubusercontent.com/u/14811089?v=3","gravatar_id":"","url":"https://api.github.com/users/gunjpan","html_url":"https://github.com/gunjpan","followers_url":"https://api.github.com/users/gunjpan/followers","following_url":"https://api.github.com/users/gunjpan/following{/other_user}","gists_url":"https://api.github.com/users/gunjpan/gists{/gist_id}","starred_url":"https://api.github.com/users/gunjpan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gunjpan/subscriptions","organizations_url":"https://api.github.com/users/gunjpan/orgs","repos_url":"https://api.github.com/users/gunjpan/repos","events_url":"https://api.github.com/users/gunjpan/events{/privacy}","received_events_url":"https://api.github.com/users/gunjpan/received_events","type":"User","site_admin":false},"milestone":null,"comments":3,"created_at":"2016-04-13T04:22:01Z","updated_at":"2016-04-14T22:50:36Z","closed_at":null,"body":"While following documentation like (https://github.com/strongloop/loopback-example-access-control) of ACL managment in Loopback Im having an issue in most basic Rule.\r\n\r\nI created a sample model called Article. Added one ACL that DENY everything to unauthenticated and only allow to authenticated users. But on explorer I can still list Articles and POST new articles without any token or authentication. \r\n\r\n```\r\n\"acls\": [\r\n    {\r\n      \"accessType\": \"READ\",\r\n      \"principalType\": \"ROLE\",\r\n      \"principalId\": \"$authenticated\",\r\n      \"permission\": \"ALLOW\"\r\n    },\r\n    {\r\n      \"accessType\": \"*\",\r\n      \"principalType\": \"ROLE\",\r\n      \"principalId\": \"$unauthenticated\",\r\n      \"permission\": \"DENY\"\r\n    }\r\n  ],\r\n```\r\n\r\nAny ideas?"},"comment":{"url":"https://api.github.com/repos/strongloop/loopback/issues/comments/210192038","html_url":"https://github.com/strongloop/loopback/issues/2222#issuecomment-210192038","issue_url":"https://api.github.com/repos/strongloop/loopback/issues/2222","id":210192038,"user":{"login":"gunjpan","id":14811089,"avatar_url":"https://avatars.githubusercontent.com/u/14811089?v=3","gravatar_id":"","url":"https://api.github.com/users/gunjpan","html_url":"https://github.com/gunjpan","followers_url":"https://api.github.com/users/gunjpan/followers","following_url":"https://api.github.com/users/gunjpan/following{/other_user}","gists_url":"https://api.github.com/users/gunjpan/gists{/gist_id}","starred_url":"https://api.github.com/users/gunjpan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gunjpan/subscriptions","organizations_url":"https://api.github.com/users/gunjpan/orgs","repos_url":"https://api.github.com/users/gunjpan/repos","events_url":"https://api.github.com/users/gunjpan/events{/privacy}","received_events_url":"https://api.github.com/users/gunjpan/received_events","type":"User","site_admin":false},"created_at":"2016-04-14T22:50:36Z","updated_at":"2016-04-14T22:50:36Z","body":"@sbehrends : Hi, I tried to reproduce the issue with ACL entries you provided and found that it is working fine and behavior is as expected i.e. to block access for `unauthenticated` users. \r\nPlease give a try to the code I uploaded here: https://github.com/gunjpan/sandbox/tree/lb2222 and see if that's something you're doing. \r\nIf not, can you provide me with a sample repo? or send a PR to that sandbox with your code?\r\n\r\nBesides, I would recommend reading [How Access Control works in LoopBack](https://docs.strongloop.com/display/APIC/Controlling+data+access#Controllingdataaccess-Definingaccesscontrol)\r\n\r\n\r\n@Neil-UWA : I don't believe re-arranging solves the issue as LoopBack determines the ultimate ACL by adding all the applicable ACLs with precedence rules for permission and access type to resolve any conflicts. More about precedence [here](https://docs.strongloop.com/display/APIC/Controlling+data+access#Controllingdataaccess-ACLruleprecedence)"}}