private function addAcl(ObjectIdentity $objectIdentity, UserSecurityIdentity $securityIdentity, array $rights)
    {
        // Getting ACL for this object identity
        try {
            $acl = $this->aclProvider->createAcl($objectIdentity);
        } catch (\Exception $e) {
            $acl = $this->aclProvider->findAcl($objectIdentity);
        }

        // Calculating mask
        $builder = new MaskBuilder();
        foreach ($rights as $right) {
            $builder->add($right);
        }
        $mask = $builder->get();

        // first revoke existing access for this security identity
        foreach($acl->getObjectAces() as $i => $ace) {
            if($securityIdentity->equals($ace->getSecurityIdentity())) {
                $acl->updateObjectAce($i, $ace->getMask() & ~$mask);
            }
        }

        // then grant
        if ('all' === $objectIdentity->getIdentifier()) {
            $acl->insertClassAce($securityIdentity, $mask);
        } else {
            $acl->insertObjectAce($securityIdentity, $mask);
        }
        $this->aclProvider->updateAcl($acl);
    }