[OAK-8190] Dedicated authorization for system users

• Type: New Feature
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.16.0
• Component/s: authorization-principalbased, security
• Assignee: Angela Schreiber
• Reporter: Angela Schreiber
• Created: 03/Apr/19 07:11
• Updated: 29/Jul/19 06:31
• Resolved: 26/Jun/19 09:05

Description

in a oak setup with immutable mounts we would like to be able to cover system users and their permissions with a separate mount. while setting up a mount for system users is feasible out of the box, this doesn't apply for the default access control content created for the associated system user principals, which due to the nature of the default authorization implementation will be distributed across the repository. in addition any entries created for any system user principal may be collocated in a mutable policy with entries for regular principals and where the order is crucial for the resulting effective permissions.Therefore it would be desirable if in a mount-based setup system users and their permission setup were to be collocated in the same mount.

stillalex, fyi

Issue Links

• is blocked by: OAK-8212 ImporterImpl.importProperties prone to NPE
• is blocked by: OAK-8155 CompositePermissionProvider: add possibility to abort evaluation
• is blocked by: OAK-8295 Update version of jackrabbit dependency
• is broken by: OAK-8490 FilterProviderImpl.getFilter may fail if principal cache enabled
• is duplicated by: OAK-8242 JavaDoc error in oak-authorization-principalbased
• is related to: JCRVLT-340 Adjust JackrabbitACLImporter to handle extensions provided by OAK-8190
• relates to: JCR-4429 Add extension of JackrabbitAccessControlList bound to a principal