NHibernate entity security/filtering -

i'm attempting coerce existing nhibernate application multi-tenant application. data model large (60+ entities) although small subset of these entities need secured. added wrinkle, data access model used in separate applications should disregard security.

to end, i've created further entities represent acl on securable entities.

i've managed looks security adding loadcollection listener. when collection of secured entities loaded, check acl each 1 , remove list if access isn't allowed.

however, can't figure out how accomplish same thing when loading single entity. have preload event listener , i'm able determine if caller has access. if don't have access, return null item. i've tried setting entity associated event null , evicting entity session.

documentation on using event pretty thin on ground: it's events fire before saving have worked examples. nhibernate cookbook uses old version of nhibernate different signature events (e.g. return bool rather void of nhibernate 3.3.x).

edit: after spelunking through nhibernate source, i've determined looking @ wrong load event. tried "preload" , "postload", not realizing plain old "load" event after.

this has raised new issue though: when loading object not secured, has secured parent, load event listener fire proxy of parent. eager-loading or not, parent proxy won't have correct acl: coming empty every time.

a full example nhibernate application using design can found in nhibernate best practices, we're using enterprise, heavy web application more 300 entities big success. on top of implemented context control mechanism, each end user requesting security token on log-in , use on every sequential call, on every sequential call check security token validation , use create additional criterion limit each user access depending on his\her configuration. big project, gave infrastructure developing , maintenance.