--- a/src/main/java/de/intevation/lada/util/auth/HeaderAuthorization.java	Fri Sep 30 11:15:32 2016 +0200
+++ b/src/main/java/de/intevation/lada/util/auth/HeaderAuthorization.java	Fri Sep 30 15:21:55 2016 +0200
@@ -27,6 +27,7 @@
 import de.intevation.lada.model.land.LProbe;
 import de.intevation.lada.model.land.LStatusProtokoll;
 import de.intevation.lada.model.land.LZusatzWert;
+import de.intevation.lada.model.land.Messprogramm;
 import de.intevation.lada.model.stamm.Auth;
 import de.intevation.lada.model.stamm.DatensatzErzeuger;
 import de.intevation.lada.model.stamm.LadaUser;
@@ -66,6 +67,7 @@
     @Inject ProbeIdAuthorizer pIdAuthorizer;
     @Inject MessungIdAuthorizer mIdAuthorizer;
     @Inject NetzbetreiberAuthorizer netzAuthorizer;
+    @Inject MessprogrammAuthorizer messprogrammAuthorizer;
 
     @SuppressWarnings("rawtypes")
     @PostConstruct
@@ -83,6 +85,7 @@
         authorizers.put(DatensatzErzeuger.class, netzAuthorizer);
         authorizers.put(MessprogrammKategorie.class, netzAuthorizer);
         authorizers.put(Ort.class, netzAuthorizer);
+        authorizers.put(Messprogramm.class, messprogrammAuthorizer);
     }
 
     /**

--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/src/main/java/de/intevation/lada/util/auth/MessprogrammAuthorizer.java	Fri Sep 30 15:21:55 2016 +0200
@@ -0,0 +1,46 @@
+/* Copyright (C) 2013 by Bundesamt fuer Strahlenschutz
+ * Software engineering by Intevation GmbH
+ *
+ * This file is Free Software under the GNU GPL (v>=3)
+ * and comes with ABSOLUTELY NO WARRANTY! Check out
+ * the documentation coming with IMIS-Labordaten-Application for details.
+ */
+package de.intevation.lada.util.auth;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import de.intevation.lada.model.land.Messprogramm;
+import de.intevation.lada.util.rest.RequestMethod;
+import de.intevation.lada.util.rest.Response;
+
+public class MessprogrammAuthorizer implements Authorizer {
+
+    @Override
+    public <T> boolean isAuthorized(
+        Object data,
+        RequestMethod method,
+        UserInfo userInfo,
+        Class<T> clazz
+    ) {
+        if (method == RequestMethod.GET) {
+            // Allow read access to everybody
+            return true;
+        }
+        Messprogramm messprogramm = (Messprogramm)data;
+        if (userInfo.getMessstellen().contains(messprogramm.getMstId())) {
+            return true;
+        }
+        return false;
+    }
+
+    @Override
+    public <T> Response filter(
+        Response data,
+        UserInfo userInfo,
+        Class<T> clazz
+    ) {
+        // Allow read access to everybody
+        return data;
+    }
+}