[OAK-8054] RepMembersConflictHandler creates property with wrong type

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 1.8.0, 1.8.1, 1.8.2, 1.8.3, 1.8.4, 1.8.5, 1.8.6, 1.8.7, 1.8.8, 1.8.9, 1.8.10, 1.8.11, 1.8.12
• Fix Version/s: 1.12.0, 1.10.1, 1.8.13
• Component/s: core, security
• Assignee: Alex Deparvu
• Reporter: Alex Deparvu
• Created: 15/Feb/19 15:06
• Updated: 05/Jun/19 15:59
• Resolved: 19/Feb/19 09:39

Description

The RepMembersConflictHandler handler uses type STRING instead of WEAKREFERENCE [0] as per the property's definition, which will trigger the type validation to fail the commit.
Running external login tests I see that the type fails as soon as the handler comes into play:

WARN  o.a.j.o.s.s.a.e.i.ExternalLoginModule - User synchronization failed during commit: org.apache.jackrabbit.oak.api.CommitFailedException: OakConstraint0004: /rep:security/rep:authorizables/rep:groups/pathPrefix/g8/rep:membersList/9[[rep:MemberReferences]]: No matching property definition found for rep:members = [8e490910-17b6-30c1-8e11-6abdfa8a4ebc, 1a8e79f5-428e-39e9-88bb-2b86bd9b402e, ... ]. (attempt 10/50)

This seems to be a pretty big issue, and I'm not yet sure why it wasn't caught by the existing tests.

// fyi anchela

[0] https://github.com/apache/jackrabbit-oak/blob/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/user/RepMembersConflictHandler.java#L135

Issue Links

• relates to: OAK-3374 Concurrent Updates of Group's Membership Results in Conflict