diff --git a/src/main/java/de/ids_mannheim/korap/interfaces/AuditingIface.java b/src/main/java/de/ids_mannheim/korap/interfaces/db/AuditingIface.java
similarity index 97%
rename from src/main/java/de/ids_mannheim/korap/interfaces/AuditingIface.java
rename to src/main/java/de/ids_mannheim/korap/interfaces/db/AuditingIface.java
index 18a616f..ed21e60 100644
--- a/src/main/java/de/ids_mannheim/korap/interfaces/AuditingIface.java
+++ b/src/main/java/de/ids_mannheim/korap/interfaces/db/AuditingIface.java
@@ -1,4 +1,4 @@
-package de.ids_mannheim.korap.interfaces;
+package de.ids_mannheim.korap.interfaces.db;
 
 import de.ids_mannheim.korap.auditing.AuditRecord;
 import de.ids_mannheim.korap.user.User;
diff --git a/src/main/java/de/ids_mannheim/korap/interfaces/EntityHandlerIface.java b/src/main/java/de/ids_mannheim/korap/interfaces/db/EntityHandlerIface.java
similarity index 96%
rename from src/main/java/de/ids_mannheim/korap/interfaces/EntityHandlerIface.java
rename to src/main/java/de/ids_mannheim/korap/interfaces/db/EntityHandlerIface.java
index aed2871..f349f23 100644
--- a/src/main/java/de/ids_mannheim/korap/interfaces/EntityHandlerIface.java
+++ b/src/main/java/de/ids_mannheim/korap/interfaces/db/EntityHandlerIface.java
@@ -1,4 +1,4 @@
-package de.ids_mannheim.korap.interfaces;
+package de.ids_mannheim.korap.interfaces.db;
 
 import de.ids_mannheim.korap.exceptions.EmptyResultException;
 import de.ids_mannheim.korap.exceptions.KustvaktException;
diff --git a/src/main/java/de/ids_mannheim/korap/interfaces/PersistenceClient.java b/src/main/java/de/ids_mannheim/korap/interfaces/db/PersistenceClient.java
similarity index 95%
rename from src/main/java/de/ids_mannheim/korap/interfaces/PersistenceClient.java
rename to src/main/java/de/ids_mannheim/korap/interfaces/db/PersistenceClient.java
index 07d53c7..c21d941 100644
--- a/src/main/java/de/ids_mannheim/korap/interfaces/PersistenceClient.java
+++ b/src/main/java/de/ids_mannheim/korap/interfaces/db/PersistenceClient.java
@@ -1,4 +1,4 @@
-package de.ids_mannheim.korap.interfaces;
+package de.ids_mannheim.korap.interfaces.db;
 
 import lombok.Getter;
 
diff --git a/src/main/java/de/ids_mannheim/korap/interfaces/PolicyHandlerIface.java b/src/main/java/de/ids_mannheim/korap/interfaces/db/PolicyHandlerIface.java
similarity index 98%
rename from src/main/java/de/ids_mannheim/korap/interfaces/PolicyHandlerIface.java
rename to src/main/java/de/ids_mannheim/korap/interfaces/db/PolicyHandlerIface.java
index 122970f..15e4296 100644
--- a/src/main/java/de/ids_mannheim/korap/interfaces/PolicyHandlerIface.java
+++ b/src/main/java/de/ids_mannheim/korap/interfaces/db/PolicyHandlerIface.java
@@ -1,4 +1,4 @@
-package de.ids_mannheim.korap.interfaces;
+package de.ids_mannheim.korap.interfaces.db;
 
 import de.ids_mannheim.korap.exceptions.KustvaktException;
 import de.ids_mannheim.korap.resources.KustvaktResource;
diff --git a/src/main/java/de/ids_mannheim/korap/interfaces/ResourceOperationIface.java b/src/main/java/de/ids_mannheim/korap/interfaces/db/ResourceOperationIface.java
similarity index 96%
rename from src/main/java/de/ids_mannheim/korap/interfaces/ResourceOperationIface.java
rename to src/main/java/de/ids_mannheim/korap/interfaces/db/ResourceOperationIface.java
index fa0bf35..260e928 100644
--- a/src/main/java/de/ids_mannheim/korap/interfaces/ResourceOperationIface.java
+++ b/src/main/java/de/ids_mannheim/korap/interfaces/db/ResourceOperationIface.java
@@ -1,4 +1,4 @@
-package de.ids_mannheim.korap.interfaces;
+package de.ids_mannheim.korap.interfaces.db;
 
 import de.ids_mannheim.korap.exceptions.KustvaktException;
 import de.ids_mannheim.korap.resources.KustvaktResource;
diff --git a/src/main/java/de/ids_mannheim/korap/interfaces/defaults/KustvaktEncryption.java b/src/main/java/de/ids_mannheim/korap/interfaces/defaults/KustvaktEncryption.java
new file mode 100644
index 0000000..a21d767
--- /dev/null
+++ b/src/main/java/de/ids_mannheim/korap/interfaces/defaults/KustvaktEncryption.java
@@ -0,0 +1,483 @@
+package de.ids_mannheim.korap.interfaces.defaults;
+
+import de.ids_mannheim.korap.config.KustvaktConfiguration;
+import de.ids_mannheim.korap.exceptions.KustvaktException;
+import de.ids_mannheim.korap.exceptions.StatusCodes;
+import de.ids_mannheim.korap.interfaces.EncryptionIface;
+import de.ids_mannheim.korap.user.User;
+import edu.emory.mathcs.backport.java.util.Collections;
+import org.apache.commons.codec.EncoderException;
+import org.apache.commons.codec.binary.Base64;
+import org.mindrot.jbcrypt.BCrypt;
+import org.owasp.esapi.ESAPI;
+import org.owasp.esapi.Randomizer;
+import org.owasp.esapi.Validator;
+import org.owasp.esapi.errors.ValidationException;
+import org.owasp.esapi.reference.DefaultValidator;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.io.UnsupportedEncodingException;
+import java.lang.reflect.Field;
+import java.lang.reflect.Modifier;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.security.SecureRandom;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+public class KustvaktEncryption implements EncryptionIface {
+
+    private static final String ALGORITHM = "SHA-256";
+    private static Logger jlog = LoggerFactory
+            .getLogger(KustvaktEncryption.class);
+    // todo: disable this
+    private static final String PASSWORD_SALT_FIELD = "accountCreation";
+
+    private final boolean nullable;
+    private final Validator validator;
+    private final Randomizer randomizer;
+    private KustvaktConfiguration config;
+
+    public KustvaktEncryption(KustvaktConfiguration config) {
+        jlog.info("initializing KorAPEncryption implementation");
+        this.nullable = false;
+        this.validator = DefaultValidator.getInstance();
+        this.randomizer = ESAPI.randomizer();
+        this.config = config;
+    }
+
+    public static boolean matchTokenByteCode(Object param) {
+        if (!(param instanceof String))
+            return false;
+        String token = (String) param;
+        byte[] bytes = token.getBytes();
+        return 64 == bytes.length;
+    }
+
+    private String encodeBase(byte[] bytes) throws EncoderException {
+        return Base64.encodeBase64String(bytes);
+    }
+
+    @Override
+    public String encodeBase() {
+        try {
+            return encodeBase(this.createSecureRandom(24));
+        }catch (EncoderException e) {
+            return "";
+        }
+    }
+
+    public String produceSecureHash(String input) {
+        return produceSecureHash(input, "");
+    }
+
+    @Override
+    public String produceSecureHash(String input, String salt) {
+        String hashString = "";
+        switch (config.getEncryption()) {
+            case ESAPICYPHER:
+                try {
+                    hashString = hash(input, salt);
+                }catch (NoSuchAlgorithmException e) {
+                    jlog.error("there was an encryption error!", e);
+                    return null;
+                }catch (Exception e) {
+                    jlog.error("there was an error!", e);
+                    return null;
+                }
+                break;
+            case SIMPLE:
+                try {
+                    MessageDigest md = MessageDigest.getInstance("SHA-256");
+                    md.update(input.getBytes("UTF-8"));
+                    byte[] digest = md.digest();
+
+                    for (byte b : digest)
+                        hashString += String.format("%02x", b);
+                }catch (UnsupportedEncodingException | NoSuchAlgorithmException e) {
+                    e.printStackTrace();
+                }
+                break;
+            case BCRYPT:
+                hashString = bcryptHash(input, salt);
+                break;
+            default:
+                jlog.warn("Invalid value: {}", config.getEncryption());
+                break;
+        }
+        return hashString;
+    }
+
+    public String hash(String text, String salt) throws Exception {
+        byte[] bytes;
+
+        MessageDigest md = MessageDigest.getInstance(ALGORITHM);
+        md.reset();
+        md.update(ESAPI.securityConfiguration().getMasterSalt());
+        md.update(salt.getBytes());
+        md.update(text.getBytes());
+
+        bytes = md.digest();
+        for (int i = 0; i < 234; ++i) {
+            md.reset();
+            bytes = md.digest(bytes);
+        }
+        String coding = ESAPI.encoder().encodeForBase64(bytes, false);
+        return coding;
+    }
+
+    @Override
+    public String hash(String input) {
+        String hashString = "";
+        MessageDigest md;
+        try {
+            md = MessageDigest.getInstance("SHA-256");
+            md.update(input.getBytes("UTF-8"));
+        }catch (NoSuchAlgorithmException e) {
+            return "";
+        }catch (UnsupportedEncodingException e) {
+            return "";
+        }
+
+        byte[] digest = md.digest();
+
+        for (byte b : digest) {
+            hashString += String.format("%02x", b);
+        }
+        return hashString;
+    }
+
+    /**
+     * // some sort of algorithm to create token and isSystem regularly the integrity
+     * // of the token
+     * public String createAuthToken() {
+     * final byte[] rNumber = SecureRGenerator
+     * .getNextSecureRandom(SecureRGenerator.TOKEN_RANDOM_SIZE);
+     * String hash;
+     * try {
+     * hash = produceSimpleHash(SecureRGenerator.toHex(rNumber));
+     * } catch (NoSuchAlgorithmException | UnsupportedEncodingException e) {
+     * return "";
+     * }
+     * return hash;
+     * }
+     */
+
+    private byte[] createSecureRandom(int size) {
+        return SecureRGenerator.getNextSecureRandom(size);
+    }
+
+    @Override
+    public String createToken(boolean hash, Object... obj) {
+        StringBuffer b = new StringBuffer();
+        try {
+            for (Object o : obj) {
+                b.append(" | ");
+                b.append(o);
+            }
+            if (hash)
+                return encodeBase(hash(b.toString().trim()).getBytes());
+            else
+                return encodeBase(b.toString().trim().getBytes());
+        }catch (EncoderException e) {
+            return "";
+        }
+
+    }
+
+    @Override
+    public String createToken() {
+        String encoded;
+        String v = randomizer
+                .getRandomString(SecureRGenerator.TOKEN_RANDOM_SIZE,
+                        SecureRGenerator.toHex(createSecureRandom(64))
+                                .toCharArray());
+        encoded = hash(v);
+        jlog.trace("creating new token {}", encoded);
+        return encoded;
+    }
+
+    @Override
+    public String createID(Object... obj) {
+        final byte[] rNumber = SecureRGenerator
+                .getNextSecureRandom(SecureRGenerator.CORPUS_RANDOM_SIZE);
+        if (obj.length != 0) {
+            ArrayList s = new ArrayList();
+            Collections.addAll(s, obj);
+            obj = s.toArray();
+        }else {
+            obj = new Object[1];
+            obj[0] = rNumber;
+        }
+        return createToken(false, obj);
+    }
+
+    @Override
+    public boolean checkHash(String plain, String hash, String salt) {
+        String pw = "";
+        switch (config.getEncryption()) {
+            case ESAPICYPHER:
+                pw = produceSecureHash(plain, salt);
+                break;
+            case BCRYPT:
+                try {
+                    return BCrypt.checkpw(plain, hash);
+                }catch (IllegalArgumentException e) {
+                    return false;
+                }
+            case SIMPLE:
+                pw = hash(plain);
+                break;
+        }
+        return pw.equals(hash);
+    }
+
+    @Override
+    public boolean checkHash(String plain, String hash) {
+        switch (config.getEncryption()) {
+            case ESAPICYPHER:
+                return produceSecureHash(plain).equals(hash);
+            case BCRYPT:
+                try {
+                    return BCrypt.checkpw(plain, hash);
+                }catch (IllegalArgumentException e) {
+                    return false;
+                }
+            case SIMPLE:
+                return hash(plain).equals(hash);
+        }
+        return false;
+    }
+
+    @Override
+    public String getSalt(User user) {
+        Class u = user.getClass();
+        Field field;
+        try {
+            field = u.getSuperclass().getDeclaredField(PASSWORD_SALT_FIELD);
+        }catch (NoSuchFieldException e) {
+            try {
+                field = u.getDeclaredField(PASSWORD_SALT_FIELD);
+            }catch (NoSuchFieldException e1) {
+                // do nothing
+                e.printStackTrace();
+                return null;
+            }
+        }
+        try {
+            field.setAccessible(true);
+            String value = String.valueOf(field.get(user));
+            field.setAccessible(false);
+            return value;
+        }catch (IllegalAccessException e) {
+            // do nothing
+            e.printStackTrace();
+        }
+        return null;
+    }
+
+    @Override
+    public Map<String, Object> validateMap(Map<String, Object> map)
+            throws KustvaktException {
+        Map<String, Object> safeMap = new HashMap<>();
+        if (map != null) {
+            for (Map.Entry<String, Object> entry : map.entrySet()) {
+                Object value = null;
+                if (entry.getValue() instanceof String) {
+                    value = validateString((String) entry.getValue());
+
+                }else if (entry.getValue() instanceof List) {
+                    List list = (List) entry.getValue();
+                    for (Object v : list) {
+                        if (v instanceof String)
+                            validateString((String) v);
+                    }
+
+                    if (((List) entry.getValue()).size() == 1)
+                        value = list.get(0);
+                    else
+                        value = list;
+                }
+                safeMap.put(entry.getKey(), value);
+            }
+        }
+        return safeMap;
+    }
+
+
+    private String validateString(String descr, String input, String type,
+            int length, boolean nullable) throws KustvaktException {
+        if (jlog.isDebugEnabled())
+            jlog.debug("validating string entry '{}'", input);
+        String s;
+        try {
+            s = validator.getValidInput(descr, input, type, length, nullable);
+        }catch (ValidationException e) {
+            jlog.error(
+                    "String value did not validate ('{}') with validation type {}",
+                    new Object[] { input, type, e.getMessage() });
+            throw new KustvaktException(StatusCodes.ILLEGAL_ARGUMENT,
+                    "invalid string of type " + type, input);
+        }
+        return s;
+    }
+
+    @Override
+    public String validateString(String input) throws KustvaktException {
+        if (input.contains("@")) {
+            return validateEmail(input);
+        }else
+            return validateString("Safe String", input, "SafeString",
+                    config.getValidationStringLength(), nullable);
+    }
+
+    @Override
+    public String validateEmail(String email) throws KustvaktException {
+        jlog.debug("validating email entry '{}'", email);
+        return validateString("Email", email, "Email",
+                config.getValidationEmaillength(), nullable);
+    }
+
+    @Override
+    public String validateIPAddress(String ipaddress) throws KustvaktException {
+        jlog.debug("validating IP address entry '{}'", ipaddress);
+        return validateString("IP Address", ipaddress, "IPAddress",
+                config.getValidationStringLength(), nullable);
+    }
+
+    @Override
+    public void validate(Object instance) throws KustvaktException {
+        if (instance == null)
+            return;
+        try {
+            validateStringField(instance.getClass().getDeclaredFields(),
+                    instance);
+            validateStringField(
+                    instance.getClass().getSuperclass().getDeclaredFields(),
+                    instance);
+        }catch (IllegalAccessException e) {
+            jlog.error("object value did not validate", e.getMessage());
+            throw new KustvaktException(StatusCodes.PARAMETER_VALIDATION_ERROR,
+                    "object could not be validated", instance.toString());
+        }
+    }
+
+    //fixme: fix validation algorithm
+    @Override
+    public String validatePassphrase(String pw) throws KustvaktException {
+        String safe_string = validateString(pw);
+        String pw_conf;
+        try {
+            pw_conf = validator
+                    .getValidInput("User Password", safe_string, "Password", 20,
+                            false);
+        }catch (ValidationException e) {
+            jlog.error("password value did not validate", e.getMessage());
+            throw new KustvaktException(StatusCodes.PARAMETER_VALIDATION_ERROR,
+                    "password did not validate", "password");
+        }
+        return pw_conf;
+    }
+
+    //FIXME: currently all sets are skipped during validation (since users should not be allowed to edit those sets anyway,
+    //I think we will be safe here
+    private void validateStringField(Field[] fields, Object instance)
+            throws KustvaktException, IllegalAccessException {
+        for (Field field : fields) {
+            boolean priv = false;
+            if (field.getType().isAssignableFrom(String.class)) {
+                if (Modifier.isPrivate(field.getModifiers())) {
+                    priv = true;
+                    field.setAccessible(true);
+                }
+                if (field.getName().equals("password") | Modifier
+                        .isFinal(field.getModifiers()))
+                    continue;
+                String val = (String) field.get(instance);
+                if (val != null) {
+                    String[] set = val.split(";");
+                    if (set.length > 1)
+                        continue;
+                }
+                String safe;
+                if (!field.getName().equals("email"))
+                    safe = validateString("Safe String", val, "SafeString",
+                            config.getValidationStringLength(), true);
+                else
+                    safe = validateString("User Email", val, "Email",
+                            config.getValidationEmaillength(), true);
+                field.set(instance, safe == null ? "" : safe);
+
+                if (priv) {
+                    field.setAccessible(false);
+                }
+            }
+        }
+    }
+
+    private String bcryptHash(String text, String salt) {
+        if (salt == null || salt.isEmpty())
+            salt = BCrypt.gensalt(config.getLoadFactor());
+        return BCrypt.hashpw(text, salt);
+    }
+
+    @Override
+    public String toString() {
+        return this.getClass().getCanonicalName();
+    }
+
+    public static class SecureRGenerator {
+        private static final String SHA1_PRNG = "SHA1PRNG";
+        protected static final int DEFAULT_RANDOM_SIZE = 128;
+        protected static final int TOKEN_RANDOM_SIZE = 128;
+        protected static final int USERID_RANDOM_SIZE = 64;
+        protected static final int CORPUS_RANDOM_SIZE = 48;
+        private static final char[] HEX_DIGIT = { '0', '1', '2', '3', '4', '5',
+                '6', '7', '8', '9', 'a', 'b', 'c', 'd', 'e', 'f', 'z', 'x', 'h',
+                'q', 'w' };
+        private static final SecureRandom sRandom__;
+
+        static {
+            try {
+                sRandom__ = SecureRandom.getInstance("SHA1PRNG");
+            }catch (NoSuchAlgorithmException e) {
+                throw new Error(e);
+            }
+        }
+
+        public static byte[] getNextSecureRandom(int bits) {
+            if (bits % 8 != 0) {
+                throw new IllegalArgumentException(
+                        "Size is not divisible by 8!");
+            }
+
+            byte[] bytes = new byte[bits / 8];
+
+            sRandom__.nextBytes(bytes);
+
+            return bytes;
+        }
+
+        public static String toHex(byte[] bytes) {
+            if (bytes == null) {
+                return null;
+            }
+
+            StringBuilder buffer = new StringBuilder(bytes.length * 2);
+            for (byte thisByte : bytes) {
+                buffer.append(byteToHex(thisByte));
+            }
+
+            return buffer.toString();
+        }
+
+        private static String byteToHex(byte b) {
+            char[] array = { HEX_DIGIT[(b >> 4 & 0xF)], HEX_DIGIT[(b & 0xF)] };
+            return new String(array);
+        }
+    }
+
+}
diff --git a/src/main/java/de/ids_mannheim/korap/resource/rewrite/IdWriter.java b/src/main/java/de/ids_mannheim/korap/resource/rewrite/IdWriter.java
new file mode 100644
index 0000000..0c91ac0
--- /dev/null
+++ b/src/main/java/de/ids_mannheim/korap/resource/rewrite/IdWriter.java
@@ -0,0 +1,8 @@
+package de.ids_mannheim.korap.resource.rewrite;
+
+/**
+ * @author hanl
+ * @date 25/09/2015
+ */
+public class IdWriter {
+}
diff --git a/src/main/java/de/ids_mannheim/korap/security/ac/PolicyDao.java b/src/main/java/de/ids_mannheim/korap/security/ac/PolicyDao.java
new file mode 100644
index 0000000..d260b65
--- /dev/null
+++ b/src/main/java/de/ids_mannheim/korap/security/ac/PolicyDao.java
@@ -0,0 +1,808 @@
+package de.ids_mannheim.korap.security.ac;
+
+import de.ids_mannheim.korap.exceptions.KustvaktException;
+import de.ids_mannheim.korap.exceptions.StatusCodes;
+import de.ids_mannheim.korap.exceptions.dbException;
+import de.ids_mannheim.korap.ext.interfaces.PolicyHandlerIface;
+import de.ids_mannheim.korap.ext.resource.KorAPResource;
+import de.ids_mannheim.korap.ext.resource.ResourceFactory;
+import de.ids_mannheim.korap.ext.security.types.Parameter;
+import de.ids_mannheim.korap.ext.security.types.PolicyCondition;
+import de.ids_mannheim.korap.ext.security.types.SecurityPolicy;
+import de.ids_mannheim.korap.interfaces.PersistenceClient;
+import de.ids_mannheim.korap.user.Attributes;
+import de.ids_mannheim.korap.user.User;
+import de.ids_mannheim.korap.utils.BooleanUtils;
+import de.ids_mannheim.korap.utils.KustvaktLogger;
+import de.ids_mannheim.korap.utils.StringUtils;
+import de.ids_mannheim.korap.utils.TimeUtils;
+import org.springframework.dao.DataAccessException;
+import org.springframework.jdbc.core.ResultSetExtractor;
+import org.springframework.jdbc.core.RowCallbackHandler;
+import org.springframework.jdbc.core.namedparam.MapSqlParameterSource;
+import org.springframework.jdbc.core.namedparam.NamedParameterJdbcTemplate;
+import org.springframework.jdbc.support.GeneratedKeyHolder;
+import org.springframework.jdbc.support.KeyHolder;
+
+import java.sql.ResultSet;
+import java.sql.SQLException;
+import java.sql.Timestamp;
+import java.util.Arrays;
+import java.util.List;
+
+/**
+ * @author hanl
+ * @date 14/01/2014
+ */
+// todo: transactions and exception management
+public class PolicyDao implements PolicyHandlerIface {
+
+    private NamedParameterJdbcTemplate jdbcTemplate;
+
+    public PolicyDao(PersistenceClient client) {
+        this.jdbcTemplate = (NamedParameterJdbcTemplate) client.getSource();
+    }
+
+    /**
+     * @param policy
+     * @param user
+     * @return int to indicate the rows updated/inserted
+     * @throws KustvaktException
+     */
+    // fixme: better way of dealing with this?
+    // fixme: enable needs to be set specifically for mysql db
+    @Override
+    public int createPolicy(SecurityPolicy policy, User user)
+            throws KustvaktException {
+        String sql =
+                "INSERT INTO policy_store (target_id, creator, created, posix, enable, expire, iprange)"
+                        + " SELECT id, :creator, :cr, :posix, :en, :exp, :ip FROM resource_store WHERE persistent_id=:target;";
+
+        if (policy.getTarget() == null)
+            throw new dbException(user.getId(), "policy_store",
+                    StatusCodes.MISSING_POLICY_TARGET, policy.toString());
+
+        if (policy.getConditions().isEmpty())
+            throw new dbException(user.getId(), "policy_store",
+                    StatusCodes.MISSING_POLICY_CONDITIONS);
+
+        if (policy.getPermissionByte() == 0)
+            throw new dbException(user.getId(), "policy_store",
+                    StatusCodes.MISSING_POLICY_PERMISSION);
+
+        KeyHolder keyHolder = new GeneratedKeyHolder();
+        MapSqlParameterSource np = new MapSqlParameterSource();
+        np.addValue("target", policy.getTarget());
+        if (policy.getContext().getEnd() != 0L)
+            np.addValue("exp", new Timestamp(policy.getContext().getEnd()));
+        else
+            np.addValue("exp", null);
+        np.addValue("en", new Timestamp(policy.getContext().getStart()));
+        np.addValue("posix", policy.getPermissionByte());
+        np.addValue("cr", new Timestamp(TimeUtils.getNow().getMillis()));
+        np.addValue("creator", user.getId());
+        np.addValue("ip", policy.getContext().getIpmask());
+
+        try {
+            mapConditionsToUsers(policy, user);
+            this.jdbcTemplate.update(sql, np, keyHolder, new String[] { "id" });
+            policy.setID(keyHolder.getKey().intValue());
+            this.mapConstraints(policy);
+            return policy.getID();
+        }catch (DataAccessException e) {
+            KustvaktLogger.SECURITY_LOGGER
+                    .error("Operation (INSERT) not possible for '{}' for user '{}'",
+                            policy.toString(), user.getId());
+            throw new dbException(user.getId(), "policy_store",
+                    StatusCodes.DB_INSERT_FAILED, policy.toString());
+        }
+    }
+
+    /**
+     * should also include a remove operation, so removed policy constraints
+     *
+     * @param policy
+     * @return
+     * @throws KustvaktException
+     */
+    // benchmark this!
+    @Override
+    public void mapConstraints(SecurityPolicy policy) throws KustvaktException {
+        final String cond = "INSERT INTO group_ref (group_id, policy_id) VALUES (:group, :policyID);";
+        final String remove = "DELETE FROM group_ref WHERE group_id=:group and policy_id=:policyID;";
+        try {
+            List<PolicyCondition> conditions = policy.getConditions();
+            int idx = 0;
+            if (!policy.getRemoved().isEmpty()) {
+                MapSqlParameterSource[] sources_removed = new MapSqlParameterSource[policy
+                        .getRemoved().size()];
+                for (Integer toremove : policy.getRemoved()) {
+                    MapSqlParameterSource source = new MapSqlParameterSource();
+                    source.addValue("group",
+                            conditions.get(toremove).getSpecifier());
+                    source.addValue("policyID", policy.getID());
+                    sources_removed[idx++] = source;
+                }
+                this.jdbcTemplate.batchUpdate(remove, sources_removed);
+            }
+
+            if (!policy.getAdded().isEmpty()) {
+                idx = 0;
+                MapSqlParameterSource[] sources = new MapSqlParameterSource[policy
+                        .getAdded().size()];
+                for (Integer add : policy.getAdded()) {
+                    MapSqlParameterSource source = new MapSqlParameterSource();
+                    source.addValue("group",
+                            conditions.get(add).getSpecifier());
+                    source.addValue("policyID", policy.getID());
+                    sources[idx++] = source;
+                }
+                this.jdbcTemplate.batchUpdate(cond, sources);
+            }
+            policy.clear();
+        }catch (DataAccessException e) {
+            KustvaktLogger.SECURITY_LOGGER
+                    .error("Operation (MAPPING POLICY CONDITIONS) not possible for '{}' for user '{}'",
+                            policy.toString(), policy.getCreator());
+            // throwing an error here is not recommended
+            //            throw new dbException(policy.getCreator(), "policy_store",
+            //                    StatusCodes.DB_INSERT_FAILED, policy.toString());
+        }
+    }
+
+    // todo: check transactional behaviour! --> rollback
+    private void mapConditionsToUsers(SecurityPolicy policy, User user)
+            throws KustvaktException {
+        for (PolicyCondition cond : policy.getConditions()) {
+            MapSqlParameterSource param = new MapSqlParameterSource();
+            param.addValue("name", cond.getSpecifier());
+            param.addValue("userid", user.getId());
+
+            try {
+                final Integer[] results = new Integer[2];
+                jdbcTemplate
+                        .query("SELECT COUNT(*) as total, (select count(*) from group_users where user_id=:userid and "
+                                        + "group_id=:name) as users FROM group_store WHERE name=:name",
+                                param, new RowCallbackHandler() {
+                                    @Override
+                                    public void processRow(ResultSet rs)
+                                            throws SQLException {
+                                        results[0] = rs.getInt("total");
+                                        results[1] = rs.getInt("users");
+                                    }
+                                });
+
+                boolean admin = false;
+                if (results[0] == 0) {
+                    admin = true;
+                    this.createCondition(cond, user);
+                }
+                if (results[1] == 0)
+                    this.addToCondition(Arrays.asList(user.getUsername()), cond,
+                            admin);
+            }catch (DataAccessException e) {
+                KustvaktLogger.SECURITY_LOGGER
+                        .error("Operation (SELECT) not possible for '{}' for user '{}'",
+                                policy.getTarget(), user.getId());
+                throw new dbException(user.getId(), "policy_store",
+                        StatusCodes.DB_GET_FAILED, policy.toString());
+            }
+        }
+    }
+
+    // fixme: does not compare permissions. parent can still disregard policy because of missing permisssions
+    @Override
+    public List<SecurityPolicy>[] getPolicies(Integer target, final User user,
+            Byte perm) {
+        MapSqlParameterSource param = new MapSqlParameterSource();
+        param.addValue("target", target);
+        param.addValue("userid", user.getId());
+        param.addValue("perm", perm);
+        param.addValue("en", new Timestamp(TimeUtils.getNow().getMillis()));
+
+        String sql_new =
+                "select pv.*, pv.perm & :perm as allowed, rh.depth, (select max(depth) from resource_tree \n"
+                        +
+                        "where child_id=rh.child_id) as max_depth from policy_view as pv "
+                        +
+                        "inner join resource_tree as rh on rh.parent_id=pv.id "
+                        +
+                        "where rh.child_id=:target and pv.enable <= :en and (pv.expire > :en or pv.expire is NULL) and "
+                        +
+                        "(pv.group_id='self' or pv.group_id in (select g.group_id from group_users as g where g.user_id=:userid)) and "
+                        +
+                        "(select sum(distinct depth) from resource_tree where child_id=rh.child_id) = "
+                        +
+                        "(select sum(distinct res.depth) from p_view as pos inner join resource_tree as res on res.parent_id=pos.id where (pos.group_id in (select g.group_id from group_users as g "
+                        +
+                        "where g.user_id=:userid) or pos.group_id='self') and res.child_id=rh.child_id group by child_id);";
+
+        try {
+            return this.jdbcTemplate.query(sql_new, param,
+                    new ResultSetExtractor<List<SecurityPolicy>[]>() {
+
+                        @Override
+                        public List<SecurityPolicy>[] extractData(ResultSet rs)
+                                throws SQLException, DataAccessException {
+                            return SecurityRowMappers.mapping(rs, user);
+                        }
+                    });
+        }catch (DataAccessException e) {
+            KustvaktLogger.SECURITY_LOGGER
+                    .error("Permission Denied for retrieval for '{}' for user '{}'",
+                            target, user.getId());
+            return new List[2];
+        }
+    }
+
+    @Override
+    public List<SecurityPolicy>[] getPolicies(String target, final User user,
+            Byte perm) {
+        MapSqlParameterSource param = new MapSqlParameterSource();
+        param.addValue("target", target);
+        param.addValue("userid", user.getId());
+        param.addValue("perm", perm);
+        param.addValue("en", new Timestamp(TimeUtils.getNow().getMillis()));
+
+        // fixme: missing constraint of user group membership!
+        String sql_new = "select pv.*, pv.perm & :perm as allowed, " +
+                "rh.depth, (select max(depth) from resource_tree " +
+                "where child_id=rh.child_id) as max_depth from p_view as pv " +
+                "inner join resource_tree as rh on rh.parent_id=pv.id " +
+                "where rh.child_id=(select id from resource_store where persistentID=:target) and "
+                +
+                "pv.enable <= :en and (pv.expire > :en or pv.expire is NULL) and "
+                +
+                "(pv.group_id='self' or pv.group_id in (select g.group_id from group_users as g where g.userid=:userid)) and "
+                +
+                "(select sum(distinct depth) from resource_tree where child_id=rh.child_id) = "
+                +
+                "(select sum(distinct res.depth) from p_view as pos inner join resource_tree as res on res.parent_id=pos.id where (pos.group_id in (select g.group_id from group_users "
+                +
+                "as g where g.userid=:userid) or pos.group_id='self') and res.child_id=rh.child_id group by child_id)";
+
+        try {
+            return this.jdbcTemplate.query(sql_new, param,
+                    new ResultSetExtractor<List<SecurityPolicy>[]>() {
+
+                        @Override
+                        public List<SecurityPolicy>[] extractData(ResultSet rs)
+                                throws SQLException, DataAccessException {
+                            return SecurityRowMappers.mapping(rs, user);
+                        }
+                    });
+        }catch (DataAccessException e) {
+            KustvaktLogger.SECURITY_LOGGER
+                    .error("Permission Denied for retrieval for '{}' for user '{}'",
+                            target, user.getId());
+            return new List[2];
+        }
+    }
+
+    @Override
+    public List<SecurityPolicy>[] findPolicies(String path, final User user,
+            Byte perm) {
+        MapSqlParameterSource param = new MapSqlParameterSource();
+        param.addValue("path", StringUtils.buildSQLRegex(path));
+        param.addValue("userid", user.getId());
+        param.addValue("perm", perm);
+        param.addValue("en", new Timestamp(TimeUtils.getNow().getMillis()));
+
+        String sql_new = "select pv.*, pv.perm & :perm as allowed, " +
+                "rh.depth, (select max(depth) from resource_tree " +
+                "where child_id=rh.child_id) as max_depth from p_view as pv " +
+                "inner join resource_tree as rh on rh.parent_id=pv.id " +
+                "where rt.name_path regexp :path and " +
+                "pv.enable <= :en and (pv.expire > :en or pv.expire is NULL) and "
+                +
+                "(pv.group_id='self' or pv.group_id in (select g.group_id from group_users as g where g.userid=:userid)) and "
+                +
+                "(select sum(distinct depth) from resource_tree where child_id=rh.child_id) = "
+                +
+                "(select sum(distinct res.depth) from p_view as pos inner join resource_tree as res on res.parent_id=pos.id where (pos.group_id in (select g.group_id from group_users "
+                +
+                "as g where g.userid=:userid) or pos.group_id='self') and res.child_id=rh.child_id group by child_id)";
+
+        try {
+            return this.jdbcTemplate.query(sql_new, param,
+                    new ResultSetExtractor<List<SecurityPolicy>[]>() {
+
+                        @Override
+                        public List<SecurityPolicy>[] extractData(ResultSet rs)
+                                throws SQLException, DataAccessException {
+                            return SecurityRowMappers.mapping(rs, user);
+                        }
+                    });
+        }catch (DataAccessException e) {
+            KustvaktLogger.SECURITY_LOGGER
+                    .error("Permission Denied for retrieval for '{}' for user '{}'",
+                            path, user.getId());
+            return new List[2];
+        }
+    }
+
+    /**
+     * @param path  if set searches in path where the child element equals name. Also applicable for root resources!
+     * @param user
+     * @param clazz
+     * @return
+     */
+    //todo: not working yet!
+    // todo: does not concern itsself with location matching, ever!
+    @Override
+    public List<KorAPResource.Container> getDescending(String path,
+            final User user, Byte b, final Class<? extends KorAPResource> clazz)
+            throws KustvaktException {
+        final MapSqlParameterSource param = new MapSqlParameterSource();
+        param.addValue("userid", user.getId());
+        param.addValue("type", ResourceFactory.getResourceMapping(clazz));
+        param.addValue("part", "%" + path);
+        param.addValue("perm", b);
+
+        String sql;
+        if (path != null && !path.isEmpty()) {
+            sql = "select pv.*, pv.perm & :perm as allowed, rh.depth, rh.name_path, (select max(depth) from resource_tree \n"
+                    +
+                    "where child_id=rh.child_id) as max_depth from p_view as pv "
+                    +
+                    "inner join resource_tree as rh on rh.child_id=pv.id " +
+                    "where pv.type=:type and (rh.name_path like :part) and ((pv.creator=:userid and pv.group_id='self') or "
+                    +
+                    "(pv.group_id in (select g.group_id from group_users as g where g.userid=:userid) and "
+                    +
+                    "(select sum(distinct depth) from resource_tree where child_id=rh.child_id) = "
+                    +
+                    "(select sum(distinct depth) from p_view as pos inner join resource_tree as res on res.parent_id=pos.id "
+                    +
+                    "where pos.group_id in (select g.group_id from group_users as g where g.userid=:userid) "
+                    +
+                    "and res.child_id=rh.child_id group by child_id))) " +
+                    "group by pv.pid, pv.id having count(distinct pv.group_id) = "
+                    +
+                    "((select count(co.group_id) from group_ref as co where co.policyid=pv.pid) or "
+                    +
+                    "(select 1 from p_view as cp2 where cp2.group_id='self' and cp2.id=pv.id)) "
+                    +
+                    "order by rh.depth asc, pv.id desc;";
+        }else {
+            sql = "select pv.*, pv.perm & :perm as allowed, rh.depth, rh.name_path, (select max(depth) from resource_tree \n"
+                    +
+                    "where child_id=rh.child_id) as max_depth from p_view as pv "
+                    +
+                    "inner join resource_tree as rh on rh.child_id=pv.id " +
+                    "where pv.type=:type and ((pv.creator=:userid and pv.group_id='self') or "
+                    +
+                    "(pv.group_id in (select g.group_id from group_users as g where g.userid=:userid) and "
+                    +
+                    "(select sum(distinct depth) from resource_tree where child_id=rh.child_id) = "
+                    +
+                    "(select sum(distinct depth) from p_view as pos inner join resource_tree as res on res.parent_id=pos.id "
+                    +
+                    "where pos.group_id in (select g.group_id from group_users as g where g.userid=:userid) "
+                    +
+                    "and res.child_id=rh.child_id group by child_id))) " +
+                    "group by pv.pid, pv.id having count(distinct pv.group_id) = "
+                    +
+                    "((select count(co.group_id) from group_ref as co where co.policyid=pv.pid) or "
+                    +
+                    "(select 1 from p_view as cp2 where cp2.group_id='self' and cp2.id=pv.id)) "
+                    +
+                    "order by rh.depth asc, pv.id desc;";
+        }
+        try {
+            return this.jdbcTemplate.query(sql, param,
+                    new SecurityRowMappers.HierarchicalResultExtractor());
+        }catch (DataAccessException e) {
+            KustvaktLogger.SECURITY_LOGGER
+                    .error("Permission Denied for retrieval for path '{}' for user '{}'",
+                            path, user.getId());
+            throw new dbException(user.getId(), "policy_store",
+                    StatusCodes.DB_GET_FAILED, path, clazz.toString());
+        }
+    }
+
+    @Override
+    public List<KorAPResource.Container> getAscending(String name, User user,
+            Byte b, Class<? extends KorAPResource> clazz)
+            throws KustvaktException {
+        final MapSqlParameterSource param = new MapSqlParameterSource();
+        param.addValue("userid", user.getId());
+        param.addValue("type", ResourceFactory.getResourceMapping(clazz));
+        param.addValue("part", "%" + name);
+        param.addValue("perm", b);
+
+        String sql;
+        if (name != null && !name.isEmpty()) {
+            sql = "select pv.*, pv.perm & :perm as allowed, rh.depth, rh.name_path,\n"
+                    +
+                    "(select max(depth) from resource_tree \n" +
+                    "where child_id=rh.child_id) as max_depth from p_view as pv\n"
+                    +
+                    "inner join resource_tree as rh on rh.child_id=pv.id\n" +
+                    "where pv.id in (select rt.parent_id from resource_tree as rt inner join resource_store rs on rs.id=rt.child_id\n"
+                    +
+                    "where rs.type=:type and rt.name_path like :part) and ((pv.creator=:userid and pv.group_id='self') or\n"
+                    +
+                    "(pv.group_id in (select g.group_id from group_users as g where g.userid=:userid) and\n"
+                    +
+                    "(select sum(distinct depth) from resource_tree where child_id=rh.child_id) =\n"
+                    +
+                    "(select sum(distinct depth) from p_view as pos inner join resource_tree as res on res.parent_id=pos.id\n"
+                    +
+                    "where pos.group_id in (select g.group_id from group_users as g where g.userid=:userid)\n"
+                    +
+                    "and res.child_id=rh.child_id group by child_id)))\n" +
+                    "group by pv.pid, pv.id having count(distinct pv.group_id) = \n"
+                    +
+                    "case when pv.creator=:userid then 1 else (select count(distinct co.group_id) "
+                    +
+                    "from group_ref as co where co.policyid=pv.pid) end order by rh.depth desc, pv.id desc;";
+        }else {
+            sql = "select pv.*, pv.perm & :perm as allowed, rh.depth, rh.name_path,\n"
+                    +
+                    "(select max(depth) from resource_tree \n" +
+                    "where child_id=rh.child_id) as max_depth from p_view as pv\n"
+                    +
+                    "inner join resource_tree as rh on rh.child_id=pv.id\n" +
+                    "where pv.id in (select rt.parent_id from resource_tree as rt inner join resource_store rs on rs.id=rt.child_id\n"
+                    +
+                    "where rs.type=:type) and ((pv.creator=:userid and pv.group_id='self') or\n"
+                    +
+                    "(pv.group_id in (select g.group_id from group_users as g where g.userid=:userid) and\n"
+                    +
+                    "(select sum(distinct depth) from resource_tree where child_id=rh.child_id) =\n"
+                    +
+                    "(select sum(distinct depth) from p_view as pos inner join resource_tree as res on res.parent_id=pos.target_id\n"
+                    +
+                    "where pos.group_id in (select g.group_id from group_users as g where g.userid=:userid)\n"
+                    +
+                    "and res.child_id=rh.child_id group by child_id)))\n" +
+                    "group by pv.pid, pv.id having count(distinct pv.group_id) = \n"
+                    +
+                    "case when pv.creator=:userid then 1 else (select count(distinct co.group_id) "
+                    +
+                    "from group_ref as co where co.policyid=pv.pid) end order by rh.depth desc, pv.id desc;";
+        }
+        try {
+            return this.jdbcTemplate.query(sql, param,
+                    new SecurityRowMappers.HierarchicalResultExtractor());
+        }catch (DataAccessException e) {
+            KustvaktLogger.SECURITY_LOGGER
+                    .error("Permission Denied for retrieval for path '{}' for user '{}'",
+                            name, user.getId());
+            throw new dbException(user.getId(), "policy_store",
+                    StatusCodes.DB_GET_FAILED, name, clazz.toString());
+        }
+    }
+
+    // todo: return all resources or only leave nodes? --> currently only leaves are returned
+    // todo: access to leave node also means that the path to the root for that permission is allowed,
+    // todo: thus all upper resource access is as well allowed
+
+    //todo: remove not used context?! --> who is allowed to do so?
+    @Override
+    public int deletePolicy(SecurityPolicy policy, User user)
+            throws KustvaktException {
+        MapSqlParameterSource param = new MapSqlParameterSource();
+        param.addValue("id", policy.getID());
+
+        try {
+            this.jdbcTemplate
+                    .update("DELETE FROM group_ref WHERE policyid=:id", param);
+            return this.jdbcTemplate
+                    .update("DELETE FROM policy_store WHERE id=:id", param);
+        }catch (DataAccessException e) {
+            KustvaktLogger.SECURITY_LOGGER
+                    .error("Operation (DELETE) not possible for '{}' for user '{}'",
+                            policy.toString(), user.getId());
+            throw new dbException(user.getId(), "policy_store, group_ref",
+                    StatusCodes.DB_DELETE_FAILED, policy.toString());
+        }
+    }
+
+    @Override
+    public void deleteResourcePolicies(String id, User user)
+            throws KustvaktException {
+        MapSqlParameterSource param = new MapSqlParameterSource();
+        param.addValue("id", id);
+        String sql = "DELETE FROM policy_store WHERE target_id=:id;";
+        try {
+            this.jdbcTemplate.update(sql, param);
+        }catch (DataAccessException e) {
+            KustvaktLogger.SECURITY_LOGGER
+                    .error("Operation (DELETE) not possible for '{}' for user '{}'",
+                            id, user.getId());
+            throw new dbException(user.getId(), "policy_store",
+                    StatusCodes.DB_DELETE_FAILED, id);
+        }
+    }
+
+    @Override
+    public int updatePolicy(SecurityPolicy policy, User user)
+            throws KustvaktException {
+        MapSqlParameterSource np = new MapSqlParameterSource();
+        np.addValue("posix", policy.getPermissionByte());
+        np.addValue("en", policy.getContext().getStart());
+        np.addValue("ex", policy.getContext().getEnd());
+        np.addValue("id", policy.getID());
+
+        try {
+            int result = this.jdbcTemplate
+                    .update("UPDATE policy_store SET posix=:posix WHERE id=:id",
+                            np);
+            this.mapConstraints(policy);
+            return result;
+        }catch (DataAccessException e) {
+            KustvaktLogger.SECURITY_LOGGER
+                    .error("Operation (UPDATE) not possible for '{}' for user '{}'",
+                            policy.toString(), user.getId());
+            throw new dbException(user.getId(), "policy_store",
+                    StatusCodes.DB_UPDATE_FAILED, policy.toString());
+        }
+    }
+
+    @Override
+    public int checkPolicy(SecurityPolicy policy, User user)
+            throws KustvaktException {
+        if (policy.getID() == -1)
+            return 0;
+
+        MapSqlParameterSource param = new MapSqlParameterSource();
+        param.addValue("id", policy.getID());
+        String sql1 = "SELECT COUNT(*) FROM policy_store AS p WHERE p.id=:id;";
+
+        try {
+            return this.jdbcTemplate.queryForObject(sql1, param, Integer.class);
+        }catch (DataAccessException e) {
+            KustvaktLogger.SECURITY_LOGGER
+                    .error("Operation (SELECT) not possible for '{}' for user '{}'",
+                            policy.getTarget(), user.getId());
+            throw new dbException(user.getId(), "policy_store",
+                    StatusCodes.DB_GET_FAILED, policy.toString());
+        }
+    }
+
+    /**
+     * checks if the user is a member of the specified group. Additional ownership can be tested via boolean flag
+     *
+     * @param user
+     * @param group
+     * @param owner
+     * @return
+     * @throws KustvaktException
+     */
+    @Override
+    public int matchCondition(User user, String group, boolean owner)
+            throws KustvaktException {
+        MapSqlParameterSource param = new MapSqlParameterSource();
+        param.addValue("userid", user.getId());
+        param.addValue("group", group);
+        param.addValue("isadmin", BooleanUtils.getBoolean(owner));
+        String sql;
+        if (owner) {
+            sql = "SELECT COUNT(*) FROM group_users AS gu INNER JOIN groupolicy_store AS gs "
+                    +
+                    "ON gs.name=gu.group_id WHERE gu.userID=:userid " +
+                    "AND gs.name=:group AND gu.admin=:isadmin;";
+        }else {
+            sql = "SELECT COUNT(*) FROM group_users AS gu INNER JOIN groupolicy_store AS gs "
+                    +
+                    "ON gs.name=gu.group_id WHERE gu.userID=:userid " +
+                    "AND gs.name=:group;";
+        }
+
+        try {
+            return this.jdbcTemplate.queryForObject(sql, param, Integer.class);
+        }catch (DataAccessException e) {
+            KustvaktLogger.SECURITY_LOGGER
+                    .error("Operation (SELECT) not possible for '{}' for user '{}'",
+                            group, user.getId());
+            throw new dbException(user.getId(), "policy_store",
+                    StatusCodes.DB_GET_FAILED, group);
+        }
+    }
+
+    private Integer createCondition(PolicyCondition condition, User user)
+            throws KustvaktException {
+        MapSqlParameterSource param = new MapSqlParameterSource();
+        KeyHolder key = new GeneratedKeyHolder();
+        param.addValue("name", condition.getSpecifier());
+        param.addValue("ex", condition.getFlags().get(Attributes.EXPORT));
+        param.addValue("qo", condition.getFlags().get(Attributes.QUERY_ONLY));
+        param.addValue("com", condition.getFlags().get(Attributes.COMMERCIAL));
+        param.addValue("sy", condition.getFlags().get(Attributes.SYM_USE));
+        param.addValue("ex", condition.getFlags().get(Attributes.LICENCE));
+        try {
+            this.jdbcTemplate
+                    .update("INSERT INTO group_store (name, sym_use, export, commercial) "
+                            + "VALUES (:name, :sy, :ex, :com);", param, key);
+            return key.getKey().intValue();
+        }catch (DataAccessException e) {
+            KustvaktLogger.SECURITY_LOGGER
+                    .error("Operation (INSERT) not possible for '{}'",
+                            condition.toString());
+            throw new dbException(user.getId(), "group_store",
+                    StatusCodes.DB_INSERT_FAILED, condition.toString());
+        }
+    }
+
+    @Override
+    public int addToCondition(String username, PolicyCondition condition,
+            boolean admin) throws KustvaktException {
+        final String insert =
+                "INSERT INTO group_users (userID, group_id, admin) " +
+                        "VALUES ((SELECT id FROM korap_users " +
+                        "WHERE username=:username), :group, :status);";
+        try {
+            MapSqlParameterSource param = new MapSqlParameterSource();
+            param.addValue("group", condition.getSpecifier());
+            param.addValue("username", username);
+            param.addValue("status", BooleanUtils.getBoolean(admin));
+            return this.jdbcTemplate.update(insert, param);
+        }catch (DataAccessException e) {
+            KustvaktLogger.SECURITY_LOGGER
+                    .error("Operation (INSERT) not possible for '{}' for user '{}'",
+                            condition.toString(), username);
+            throw new dbException(null, "group_store",
+                    StatusCodes.DB_INSERT_FAILED, condition.toString());
+        }
+    }
+
+    /**
+     * @param usernames
+     * @param condition
+     * @param admin
+     * @return
+     * @throws KustvaktException userID and group_id have a unique constraint,
+     *                        thus: if any of the supplied users is already a member of the group, the entire chain will be broken!
+     */
+    //todo definitely needs rework
+    //todo: test the unique index constraints!
+    @Override
+    public int[] addToCondition(List<String> usernames,
+            PolicyCondition condition, boolean admin) throws KustvaktException {
+        MapSqlParameterSource[] sources = new MapSqlParameterSource[usernames
+                .size()];
+
+        //        todo: use unique index for that! problematic though --> why?
+        //        final String select = "select count(id) from group_users where userID=" +
+        //                "(select id from korap_users where username=:username) " +
+        //                "AND group_id=:group;";
+
+        //todo: use index to create uniqueness. how to batch?
+        final String insert =
+                "INSERT INTO group_users (user_id, group_id, admin) " +
+                        "VALUES ((SELECT id FROM korap_users " +
+                        "WHERE username=:username), :group, :status);";
+        try {
+            for (int idx = 0; idx < usernames.size(); idx++) {
+                if (usernames.get(idx) == null || usernames.get(idx).isEmpty())
+                    throw new KustvaktException(StatusCodes.ILLEGAL_ARGUMENT);
+
+                MapSqlParameterSource param = new MapSqlParameterSource();
+                param.addValue("group", condition.getSpecifier());
+                param.addValue("username", usernames.get(idx));
+                param.addValue("status", BooleanUtils.getBoolean(admin));
+                // if primary keys uniqueness is determined by both keys, then use
+                // that as checkup (may also be manageable via triggers)
+                //                if (this.jdbcTemplate
+                //                        .queryForObject(select, param, Integer.class) == 0)
+                sources[idx] = param;
+            }
+
+            // todo: only insert if user is not already a member of this group
+            //fixme: problem - unique constraints throws exception. skip that user entry?!
+            return this.jdbcTemplate.batchUpdate(insert, sources);
+        }catch (DataAccessException e) {
+            KustvaktLogger.SECURITY_LOGGER
+                    .error("Operation (INSERT) not possible for '{}' for user '{}'",
+                            condition.toString(), usernames);
+            throw new KustvaktException(e, StatusCodes.CONNECTION_ERROR);
+        }
+    }
+
+    @Override
+    public void removeFromCondition(List<String> usernames,
+            PolicyCondition condition) throws KustvaktException {
+        MapSqlParameterSource[] sources = new MapSqlParameterSource[usernames
+                .size()];
+        int idx = 0;
+        for (String s : usernames) {
+            MapSqlParameterSource param = new MapSqlParameterSource();
+            param.addValue("group", condition.getSpecifier());
+            param.addValue("username", s);
+            sources[idx++] = param;
+        }
+
+        final String del =
+                "DELETE FROM group_users WHERE group_id=:group AND userID=(SELECT id FROM "
+                        + "korap_users WHERE username=:username);";
+
+        try {
+            this.jdbcTemplate.batchUpdate(del, sources);
+        }catch (DataAccessException e) {
+            KustvaktLogger.SECURITY_LOGGER
+                    .error("Operation (DELETE) not possible for '{}' for user '{}'",
+                            condition.toString(), usernames);
+            throw new KustvaktException(e, StatusCodes.CONNECTION_ERROR);
+        }
+    }
+
+    @Override
+    public void createParamBinding(Parameter param) throws KustvaktException {
+        MapSqlParameterSource source = new MapSqlParameterSource();
+        source.addValue("key", param.getName());
+        source.addValue("policy", param.getPolicy().getID());
+        source.addValue("value", param.getValue());
+        source.addValue("flag", param.isEquality());
+
+        if (!parameterExists(param.getName()))
+            createParameter(param.getName(), "", param.getOwner());
+        final String insert =
+                "INSERT INTO param_map (paramID, policy_id, value, flag) VALUES ((SELECT id FROM param_store "
+                        + "WHERE p_key=:key), (SELECT id FROM policy_store WHERE id=:policy), :value, :flag);";
+        try {
+            this.jdbcTemplate.update(insert, source);
+        }catch (DataAccessException e) {
+            KustvaktLogger.SECURITY_LOGGER
+                    .error("Operation (INSERT) not possible for '{}",
+                            param.toString());
+            throw new KustvaktException(e, StatusCodes.CONNECTION_ERROR);
+        }
+    }
+
+    @Override
+    public List<String> getUsersFromCondition(PolicyCondition condition)
+            throws KustvaktException {
+        MapSqlParameterSource source = new MapSqlParameterSource();
+        source.addValue("specifier", condition.getSpecifier());
+        final String sql1 =
+                "SELECT username FROM korap_users WHERE id IN (SELECT user_id FROM "
+                        + "group_users WHERE group_id=:specifier);";
+        try {
+            return this.jdbcTemplate.queryForList(sql1, source, String.class);
+        }catch (DataAccessException e) {
+            e.printStackTrace();
+            KustvaktLogger.SECURITY_LOGGER
+                    .error("Operation (SELECT) not possible for '{}'",
+                            condition.toString());
+            throw new KustvaktException(StatusCodes.CONNECTION_ERROR);
+        }
+    }
+
+    private boolean parameterExists(String key) {
+        MapSqlParameterSource source = new MapSqlParameterSource();
+        source.addValue("key", key);
+        final String select = "SELECT COUNT(*) FROM param_store WHERE p_key=:key;";
+        return this.jdbcTemplate.queryForObject(select, source, Integer.class)
+                == 1;
+    }
+
+    private void createParameter(String parameter, String value, Integer owner)
+            throws KustvaktException {
+        MapSqlParameterSource source = new MapSqlParameterSource();
+        source.addValue("name", parameter);
+        source.addValue("value", value);
+        source.addValue("owner", owner);
+        final String sql = "INSERT INTO param_store (p_key, p_value) VALUES (:name, :value);";
+        try {
+            this.jdbcTemplate.update(sql, source);
+        }catch (DataAccessException e) {
+            throw new KustvaktException(e, StatusCodes.CONNECTION_ERROR);
+        }
+    }
+
+    @Override
+    public void removeParamBinding(SecurityPolicy policy)
+            throws KustvaktException {
+        MapSqlParameterSource source = new MapSqlParameterSource();
+        source.addValue("id", policy.getID());
+        final String sql = "DELETE FROM param_map WHERE policy_id=:id";
+        try {
+            this.jdbcTemplate.update(sql, source);
+        }catch (DataAccessException e) {
+            throw new KustvaktException(e, StatusCodes.CONNECTION_ERROR);
+        }
+    }
+
+}
diff --git a/src/main/java/de/ids_mannheim/korap/security/ac/SecurityRowMappers.java b/src/main/java/de/ids_mannheim/korap/security/ac/SecurityRowMappers.java
new file mode 100644
index 0000000..bf2de64
--- /dev/null
+++ b/src/main/java/de/ids_mannheim/korap/security/ac/SecurityRowMappers.java
@@ -0,0 +1,239 @@
+package de.ids_mannheim.korap.security.ac;
+
+import de.ids_mannheim.korap.ext.resource.KorAPResource;
+import de.ids_mannheim.korap.ext.resource.ResourceFactory;
+import de.ids_mannheim.korap.ext.security.types.PolicyCondition;
+import de.ids_mannheim.korap.ext.security.types.PolicyContext;
+import de.ids_mannheim.korap.ext.security.types.SecurityPolicy;
+import de.ids_mannheim.korap.user.User;
+import de.ids_mannheim.korap.utils.PrefixTreeMap;
+import lombok.Data;
+import org.springframework.dao.DataAccessException;
+import org.springframework.jdbc.core.ResultSetExtractor;
+import org.springframework.jdbc.core.RowMapper;
+
+import java.sql.ResultSet;
+import java.sql.SQLException;
+import java.sql.Timestamp;
+import java.util.*;
+
+/**
+ * @author hanl
+ * @date 03/03/2014
+ */
+public class SecurityRowMappers {
+
+    public static class PolicyRowMapper implements RowMapper<SecurityPolicy> {
+
+        @Override
+        public SecurityPolicy mapRow(ResultSet rs, int rowNum)
+                throws SQLException {
+            SecurityPolicy p = new SecurityPolicy();
+            p.setID(rs.getInt("pid")).setTarget(rs.getString("persistent_id"))
+                    .setPOSIX(rs.getString("perm"));
+
+            PolicyContext context = new PolicyContext();
+            context.setIPMask(rs.getString("iprange"));
+            Timestamp date = rs.getTimestamp("enable");
+            Timestamp date2 = rs.getTimestamp("expire");
+            if (date != null)
+                context.setEnableTime(date.getTime());
+            if (date2 != null)
+                context.setExpirationTime(date2.getTime());
+            //            context.addFlag("export", rs.getBoolean("export"));
+            //            context.addFlag("sym_use", rs.getInt("sym_use"));
+            p.setContext(context);
+            return p;
+        }
+    }
+
+    @Data
+    public static class FlagContext extends PolicyContext {
+
+        private Map<String, Object> flags;
+
+        public FlagContext() {
+            this.flags = new HashMap<>();
+        }
+
+        public FlagContext addFlag(String key, Object value) {
+            this.flags.put(key, value);
+            return this;
+        }
+
+        public FlagContext removeFlag(String key) {
+            this.flags.remove(key);
+            return this;
+        }
+
+        public FlagContext clearFlags() {
+            this.flags.clear();
+            return this;
+        }
+    }
+
+    public static List<SecurityPolicy>[] mapping(ResultSet rs, User user)
+            throws SQLException {
+        List<SecurityPolicy>[] policyArray = null;
+        List<Integer>[] idx = null;
+        while (rs.next()) {
+            // user has no permission here --> thus skip
+            if (rs.getInt("allowed") == 0)
+                continue;
+
+            if (policyArray == null) {
+                int v = rs.getInt("max_depth") + 1;
+                policyArray = new List[v];
+                idx = new List[v];
+            }
+
+            int depth = rs.getInt("depth");
+
+            if (policyArray[depth] == null) {
+                policyArray[depth] = new ArrayList<>();
+                idx[depth] = new ArrayList<>();
+            }
+
+            Integer pid = rs.getInt("pid");
+            String grouping = rs.getString("group_ref");
+            Integer index = idx[depth].indexOf(pid);
+
+            SecurityPolicy policy;
+            if (index == -1) {
+                if (pid == -1 && grouping.equalsIgnoreCase("self")) {
+                    policy = new SecurityPolicy.OwnerPolicy(
+                            rs.getString("persistent_id"), rs.getInt("creator"));
+                    policyArray[depth].add(0, policy);
+                    idx[depth].add(0, pid);
+                }else {
+                    policy = new SecurityRowMappers.PolicyRowMapper()
+                            .mapRow(rs, 0);
+                    policyArray[depth].add(policy);
+                    idx[depth].add(pid);
+
+                    //todo:
+                    //                    if (policy.isActive(user)) {
+                    //                        policyArray[depth].add(policy);
+                    //                        idx[depth].add(pid);
+                    //                    }
+                }
+            }else
+                policy = policyArray[depth].get(index);
+
+            PolicyCondition c = new PolicyCondition(rs.getString("group_ref"));
+            if (!policy.contains(c))
+                policy.addCondition(c);
+        }
+        return policyArray;
+    }
+
+    @Deprecated
+    public static List<SecurityPolicy>[] map(ResultSet rs) throws SQLException {
+        Map<Integer, SecurityPolicy>[] policyArray = null;
+        while (rs.next()) {
+            // user has no permission here!
+            if (rs.getInt("allowed") == 0)
+                continue;
+
+            if (policyArray == null)
+                policyArray = new Map[rs.getInt("max_depth") + 1];
+
+            int depth = rs.getInt("depth");
+            Map<Integer, SecurityPolicy> cursor = policyArray[depth];
+            if (cursor == null)
+                cursor = new HashMap<>();
+
+            Integer pid = rs.getInt("pid");
+            SecurityPolicy policy = cursor.get(pid);
+            if (policy == null) {
+                policy = new SecurityRowMappers.PolicyRowMapper().mapRow(rs, 0);
+                cursor.put(pid, policy);
+            }
+            PolicyCondition c = new PolicyCondition(rs.getString("group_ref"));
+
+            if (!policy.contains(c))
+                policy.addCondition(c);
+        }
+
+        List<SecurityPolicy>[] results;
+        if (policyArray == null) {
+            results = new List[1];
+            results[0] = new ArrayList<>();
+        }else {
+            results = new List[policyArray.length];
+            for (int idx = 0; idx < policyArray.length; idx++) {
+                if (policyArray[idx] != null)
+                    results[idx] = new ArrayList<>(policyArray[idx].values());
+                else
+                    results[idx] = new ArrayList<>();
+            }
+        }
+        return results;
+    }
+
+    public static class HierarchicalResultExtractor
+            implements ResultSetExtractor<List<KorAPResource.Container>> {
+
+        private boolean _withpid;
+
+        //        public HierarchicalResultExtractor(boolean wpid) {
+        //            this._withpid = wpid;
+        //        }
+
+        // todo: in order for this to work, all parent flags need to be matched in sql!
+        public List<KorAPResource.Container> extractData(ResultSet rs)
+                throws SQLException, DataAccessException {
+            // contains the container with the highest available name_path to retrieve partial matches!
+            PrefixTreeMap<KorAPResource.Container[]> containerMap = new PrefixTreeMap<>();
+            Map<Integer, SecurityPolicy> trace = new HashMap<>();
+
+            while (rs.next()) {
+                KorAPResource.Container[] cursor;
+                Integer pid = rs.getInt("pid");
+
+                SecurityPolicy policy = trace.get(pid);
+                if (policy == null | pid == -1) {
+                    //                    Integer id = rs.getInt("id");
+                    String persistentId = rs.getString("persistent_id");
+                    int depth = rs.getInt("depth");
+                    String namePath = rs.getString("name_path");
+                    policy = new SecurityRowMappers.PolicyRowMapper()
+                            .mapRow(rs, 0);
+
+                    //todo: put active status here!
+                    trace.put(pid, policy);
+
+                    //fixme: since leaves are mentioned first, maybe retrieve
+                    SortedMap<String, KorAPResource.Container[]> submatch;
+                    if ((submatch = containerMap.getPrefixSubMap(namePath))
+                            == null) {
+
+                        cursor = new KorAPResource.Container[depth + 1];
+                        cursor[depth] = new KorAPResource.Container(
+                                persistentId,
+                                ResourceFactory.getResource(rs.getInt("type"))
+                                        .getClass());
+                        containerMap.put(namePath, cursor);
+                    }else {
+                        KorAPResource.Container[] values = submatch
+                                .get(submatch.firstKey());
+                        values[depth] = new KorAPResource.Container(
+                                persistentId,
+                                ResourceFactory.getResource(rs.getInt("type"))
+                                        .getClass());
+                    }
+                }
+            }
+
+            List<KorAPResource.Container> result = new ArrayList<>();
+            for (KorAPResource.Container[] values : containerMap.values()) {
+                for (KorAPResource.Container container : values)
+                    if (container == null)
+                        containerMap.remove(values);
+                result.add(values[values.length - 1]);
+            }
+            return result;
+        }
+    }
+
+}
diff --git a/src/main/resources/log4j.properties b/src/main/resources/log4j.properties
new file mode 100644
index 0000000..602c496
--- /dev/null
+++ b/src/main/resources/log4j.properties
@@ -0,0 +1,22 @@
+
+# Root logger option
+#log4j.threshold=ALL
+log4j.rootLogger=INFO, stdout, debugLog
+log4j.logger.log=ERROR, errorLog
+
+# Direct log messages to stdout
+log4j.appender.stdout=org.apache.log4j.ConsoleAppender
+log4j.appender.stdout.Target=System.out
+log4j.appender.stdout.layout=org.apache.log4j.PatternLayout
+log4j.appender.stdout.layout.ConversionPattern=%d{yyyy-MM-dd, HH:mm:ss} %C{6} - %M%n %-5p: %m%n
+
+log4j.appender.errorLog=org.apache.log4j.RollingFileAppender
+log4j.appender.errorLog.layout=org.apache.log4j.PatternLayout
+log4j.appender.errorLog.layout.ConversionPattern=%d{MMM dd, yyyy HH:mm:ss} %C{6} - %M %n %-5p: %m%n
+log4j.appender.errorLog.File=./logs/errors.log
+
+
+log4j.appender.debugLog=org.apache.log4j.RollingFileAppender
+log4j.appender.debugLog.layout=org.apache.log4j.PatternLayout
+log4j.appender.debugLog.layout.ConversionPattern=%d{MMM dd, yyyy HH:mm:ss} %C{6} - %M %n %-5p: %m%n
+log4j.appender.debugLog.File=./logs/logging.log
\ No newline at end of file