diff --git a/search-services/alfresco-solrclient-lib/source/java/org/alfresco/solr/client/AclReaders.java b/search-services/alfresco-solrclient-lib/source/java/org/alfresco/solr/client/AclReaders.java
index 5acadfa79..6d039d4b8 100644
--- a/search-services/alfresco-solrclient-lib/source/java/org/alfresco/solr/client/AclReaders.java
+++ b/search-services/alfresco-solrclient-lib/source/java/org/alfresco/solr/client/AclReaders.java
@@ -18,6 +18,7 @@
  */
 package org.alfresco.solr.client;
 
+import java.util.Collections;
 import java.util.List;
 
 /**
@@ -30,15 +31,18 @@ public class AclReaders
     private final long id;
 
     private final List<String> readers;
+    
+    private final List<String> denied;
 
     private final long aclChangeSetId;
     
     private final String tenantDomain;
 
-    public AclReaders(long id, List<String> readers, long aclChangeSetId, String tenantDomain)
+    public AclReaders(long id, List<String> readers, List<String> denied, long aclChangeSetId, String tenantDomain)
     {
         this.id = id;
         this.readers = readers;
+        this.denied = denied;
         this.aclChangeSetId = aclChangeSetId;
         this.tenantDomain = tenantDomain;
     }
@@ -46,7 +50,7 @@ public class AclReaders
     @Override
     public String toString()
     {
-        return "AclReaders [id=" + id + ", readers=" + readers + ", tenantDomain=" + tenantDomain + "]";
+        return "AclReaders [id=" + id + ", readers=" + readers + ", denied=" + denied + ", tenantDomain=" + tenantDomain + "]";
     }
 
     @Override
@@ -57,6 +61,7 @@ public class AclReaders
         result = prime * result + (int) (aclChangeSetId ^ (aclChangeSetId >>> 32));
         result = prime * result + (int) (id ^ (id >>> 32));
         result = prime * result + ((readers == null) ? 0 : readers.hashCode());
+        result = prime * result + ((denied == null) ? 0 : denied.hashCode());
         return result;
     }
 
@@ -81,6 +86,13 @@ public class AclReaders
         }
         else if (!readers.equals(other.readers))
             return false;
+        if (denied == null)
+        {
+            if (other.denied != null)
+                return false;
+        }
+        else if (!denied.equals(other.denied))
+            return false;
         return true;
     }
 
@@ -94,6 +106,11 @@ public class AclReaders
         return readers;
     }
 
+    public List<String> getDenied()
+    {
+        return readers;
+    }
+
     public long getAclChangeSetId()
     {
         return aclChangeSetId;
diff --git a/search-services/alfresco-solrclient-lib/source/java/org/alfresco/solr/client/SOLRAPIClient.java b/search-services/alfresco-solrclient-lib/source/java/org/alfresco/solr/client/SOLRAPIClient.java
index 6454436df..4bca0b215 100644
--- a/search-services/alfresco-solrclient-lib/source/java/org/alfresco/solr/client/SOLRAPIClient.java
+++ b/search-services/alfresco-solrclient-lib/source/java/org/alfresco/solr/client/SOLRAPIClient.java
@@ -348,12 +348,9 @@ public class SOLRAPIClient
             JSONObject aclReadersJSON = aclsReadersJSON.getJSONObject(i);
             long aclId = aclReadersJSON.getLong("aclId");
             JSONArray readersJSON = aclReadersJSON.getJSONArray("readers");
-            List<String> readers = new ArrayList<String>(aclReadersJSON.length());
-            for (int j = 0; j < readersJSON.length(); j++)
-            {
-                String readerJSON = readersJSON.getString(j);
-                readers.add(readerJSON);
-            }
+            List<String> readers = authorityListFromJSON(readersJSON);
+            JSONArray deniedJSON = aclReadersJSON.getJSONArray("denied");
+            List<String> denied = authorityListFromJSON(deniedJSON);
             long aclChangeSetId = aclReadersJSON.getLong("aclChangeSetId");
             
             String tenantDomain = aclReadersJSON.getString("tenantDomain");
@@ -362,13 +359,31 @@ public class SOLRAPIClient
                 tenantDomain = TenantService.DEFAULT_DOMAIN;
             }
             
-            AclReaders aclReaders = new AclReaders(aclId, readers, aclChangeSetId, tenantDomain);
+            AclReaders aclReaders = new AclReaders(aclId, readers, denied, aclChangeSetId, tenantDomain);
             aclsReaders.add(aclReaders);
         }
         // Done
         return aclsReaders;
     }
     
+    /**
+     * Convert a JSON array of authorities to a simple Java List&lt;String&gt;
+     * 
+     * @param jsonArray
+     * @return List&lt;String&gt;
+     * @throws JSONException
+     */
+    private List<String> authorityListFromJSON(JSONArray jsonArray) throws JSONException
+    {
+        List<String> authorities = new ArrayList<String>(jsonArray.length());
+        for (int j = 0; j < jsonArray.length(); j++)
+        {
+            String authority = jsonArray.getString(j);
+            authorities.add(authority);
+        }
+        return authorities;
+    }
+    
     public Transactions getTransactions(Long fromCommitTime, Long minTxnId, Long toCommitTime, Long maxTxnId, int maxResults) throws AuthenticationException, IOException, JSONException
     {
         StringBuilder url = new StringBuilder(GET_TRANSACTIONS_URL);