Spring Security 4 ACL - User Creation and DB Configuration

Question

I am in the process of implementing Spring Security into an existing application, which creates users, assigns roles and et al via a web portal. In the process of finding the best suited security for the web services and portal, I am deeply impressed with the Spring Security's ACL. However I have this basic doubt.

ACL in SS4 can be configured through a database. Found a tutorial which helps me achieve the same, but I feel that this way of configuring requires a lot of hard wiring into the database as it is completely data driven. Every user when created, would require a set of Domain Object level accesses allowed / restricted (inserting and updating rows of data into acl tables) and this will need to repeated for every user. This is much easier achieved using @PreAuthorize and @PostAuthorize annotations in the code (via SPEL) than through the database's data driven approach.

Is it possible for ACL to be configured in DB as per the roles assigned to them, than defining access for each object for each user?

Answer 1

From spring security documentation,

ACL_SID allows us to uniquely identify any principal or authority in the system ("SID" stands for "security identity"). The only columns are the ID, a textual representation of the SID, and a flag to indicate whether the textual representation refers to a principal name or a GrantedAuthority.

Thus, as roles can be assimilated to granted authorities, you should be able to assign a specific permission on an object for users of a given role.