title: Granting permissions in Spring Security ACL
body: <p>I am using the Spring Security ACL plugin in grails 1.3.7, but my question is probably more generic than that: I would like to allow users who have <code>BasePermission.READ</code> access to an object to be able to grant that same permission to other users. If user1 has read access to a document, he should be able to share that with user2, and thereby give him read access to the same document. </p>
  
  <p>When the document is first created, user1 is granted read access, so I see this in the log:</p>
  
  <pre><code>DEBUG   grails.app.service.org.grails.plugins.springsecurity.service.acl.AclUtilService     Added permission BasePermission[...............................R=1] for Sid PrincipalSid[User user1] for com.fxpal.ara.Document with id 1
  </code></pre>
  
  <p>Then I try to grant the READ permission to user2 while authenticated as user1, I get this exception:</p>
  
  <pre><code>org.springframework.security.acls.model.NotFoundException: Unable to locate a matching ACE for passed permissions and SIDs
  </code></pre>
  
  <p>So my questions are:
  1. Is having <code>BasePermission.ADMINISTRATION</code> required to allow users to grant permissions to other users?
  2. Is there some other way to grant permissions while having only partial permissions? Where is this policy implemented, and can it be replaced?</p>
  
  <p><strong>Update:</strong> </p>
  
  <p>Well, I thought I could add a new implementation of <code>AclAuthorizationStrategy</code> which defines the method <code>public void securityCheck(Acl acl, int changeType)</code>, but this method doesn't take the requested permission as a parameter, foiling my strategy of checking for compatible permissions. The next thing to do would be to re-implement AclImpl to use different logic. Seems like a shame to repeat most of the same code...</p>