title: Spring Security ACL - Allow Users to 'read' one field from the Domain class
body: <p>I'm very new to the Spring Security Framework and I have a little problem here to solve.</p>
  
  <p>I've already managed to use the @PreAuthorized("hasPermission('#person', Permission) annotation for service and controller methods.
  This works fine for me, but this only works for the whole Domain class.</p>
  
  <p>In my case there are some fields which should be shown to users despite they haven't the permission to read this Person.</p>
  
  <p>A quick example:</p>
  
  <ol>
  <li>A user logs in.</li>
  <li>He'd like to visit the profile page from Jon Doe.</li>
  <li>But the user did not have the right to read Jon Doe.</li>
  <li>The System should notice the user that he hasn't the rights and shows the
  Name like: You doesn't have the permission to read the profile from Jon Doe."</li>
  </ol>
  
  <p>This is a very simple example, there are more fields a user could see.</p>
  
  <p>Hopefully you'll understand what I'm asking for.</p>
  
  <p>(I´m sorry my english is not that good.)</p>
  
  <p><strong>EDIT</strong></p>
  
  <p><strong>PersonController</strong></p>
  
  <pre><code> @RequestMapping("/{id}")
   public String get(@PathVariable("id") Long personId, Model model,HttpSession session) {
  
      Person person = personService.findById(personId);
  
      /* DO STUFF HERE */
  
      return "person.show";
  }
  </code></pre>
  
  <p><strong>PersonService</strong></p>
  
  <pre><code>@PreAuthorize("hasPermission('#personId', &lt;domainClass&gt;, 'read')")
  public Person findById(Long personId) {
      return personRepository.findOne(personId);
  }
  </code></pre>