core/src/main/java/org/sakaiproject/nakamura/lite/accesscontrol/AccessControlManagerImpl.java
public void signContentToken(Content token, String securityZone, String objectPath) throws StorageClientException,
            AccessDeniedException {
        long t = System.currentTimeMillis();
        try {
            checkOpen();
            check(Security.ZONE_CONTENT, objectPath, Permissions.CAN_WRITE_ACL);
            check(Security.ZONE_CONTENT, objectPath, Permissions.CAN_READ_ACL);
            String key = this.getAclKey(securityZone, objectPath);
            Map<String, Object> currentAcl = getCached(keySpace, aclColumnFamily, key);
            String secretKey = (String) currentAcl.get(_SECRET_KEY);
            principalTokenValidator.signToken(token, secretKey);
            // the caller must save the target.
        } finally {
            statsService.apiCall(AccessControlManagerImpl.class.getName(), "signContentToken", System.currentTimeMillis() - t);
        }
    }
public void signContentToken(Content token, String securityZone, String objectPath) throws StorageClientException,
            AccessDeniedException {
        long t = System.currentTimeMillis();
        try {
            checkOpen();
            check(Security.ZONE_CONTENT, objectPath, Permissions.CAN_WRITE_ACL);
            check(Security.ZONE_CONTENT, objectPath, Permissions.CAN_READ_ACL);
            String key = this.getAclKey(securityZone, objectPath);
            Map<String, Object> currentAcl = getCached(keySpace, aclColumnFamily, key);
            String secretKey = (String) currentAcl.get(_SECRET_KEY);
            principalTokenValidator.signToken(token, secretKey);
            // the caller must save the target.
        } finally {
            statsService.apiCall(AccessControlManagerImpl.class.getName(), "signContentToken", System.currentTimeMillis() - t);
        }
    }
Content Tokens activate ACEs for a user that holds the content token. The
token is signed by the secret key associated with the target Object/acl
and the token is token content item is then returned for the caller to
save.