[OAK-1348] ACE merging not behaving correctly if not using managed principals

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 0.15
• Fix Version/s: 0.16
• Component/s: security
• Assignee: Angela Schreiber
• Reporter: Tobias Bocanegra
• Created: 22/Jan/14 02:42
• Updated: 10/Feb/14 13:51
• Resolved: 28/Jan/14 15:12

Description

org.apache.jackrabbit.api.security.JackrabbitAccessControlList#addEntry() does not work correctly, if the given principal is not retrieved from the PrincipalManager.

Exception:

Caused by: org.apache.jackrabbit.oak.api.CommitFailedException: OakAccessControl0013: Duplicate ACE found in policy
	at org.apache.jackrabbit.oak.security.authorization.accesscontrol.AccessControlValidator.accessViolation(AccessControlValidator.java:278)
	at org.apache.jackrabbit.oak.security.authorization.accesscontrol.AccessControlValidator.checkValidPolicy(AccessControlValidator.java:188)

this used to work in jackrabbit 2.x.

the problem is probably in org.apache.jackrabbit.oak.security.authorization.accesscontrol.ACL#internalAddEntry where the principals are "equalled" instead of comparing their names.

note, that adding an ACE with such a principal works, just the merging/overwriting detection doesn't.

test:

  Principal p1 = new Principal() { getName(){return "foo"}};
  Principal p2 = new Principal() { getName(){return "foo"}};
  acl.addEntry(p1, privileges, true);
  acl.addEntry(p2, privileges, false);
  ...
  save(); // throws