[OAK-9775] ACEs with unsupported restrictions must be cleared upon editing

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Fix Version/s: 1.44.0
• Component/s: authorization-principalbased, core, security, security-spi
• Assignee: Angela Schreiber
• Reporter: Angela Schreiber
• Created: 19/May/22 13:51
• Updated: 15/Jul/22 14:53
• Resolved: 30/May/22 06:35

Description

if the tree presentation of an access control list contains restrictions that are not supported the restriction provider will ignore them upon reading the policy from the content repository.

this will lead to ACEs being generated that contain an incomplete restriction set. however, the access control manager fails to detect them as incomplete or invalid, which upon editing of the policy will lead to

• incomplete ACEs being written back or
• AccessControlValidator failing in case the incomplete ACEs result in duplications

instead ACEs containing unsupported restrictions must be detected and removed from the policy upon editing (with a error being logged).

how to get there:

• custom restrictions being written to the repository and the custom restriction provider being uninstalled from the security setup
• using newer restrictions and then using that repository content with an older oak version that doesn't support those restrictions

Issue Links

• causes: OAK-9791 Missing check for restriction node being present
• relates to: OAK-9778 Improve exception message with OakAccessControl0013 regarding ACE duplicates
• requires: OAK-9782 CompositeRestrictionProvider must call validate on aggregated providers
• Testing discovered: OAK-9782 CompositeRestrictionProvider must call validate on aggregated providers
• Testing discovered: OAK-9779 PermissionConstants.PERMISSION_PROPERTY_NAMES does not list rep:isAllow
• links to: GitHub Pull Request #574