[SLING-10321] Deprecate service mapping by userID

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: Service User Mapper 1.5.2
• Fix Version/s: Service User Mapper 1.5.4
• Component/s: Service User Mapper
• Assignee: Angela Schreiber
• Reporter: Angela Schreiber
• Created: 20/Apr/21 07:48
• Updated: 28/Mar/23 08:19
• Resolved: 21/Apr/21 08:33

Description

cziegeler, kpauls, for security reasons I would like to deprecate the old service user mapping by a single userID in favor of the new format that takes one or multiple principal names.
The new format allows to keep service permissions limited to service-users as declared in the mapping and doesn't resolve declare or inherited group permissions. This gives full control over the effective permissions granted to each service and doesn't risk unrelated permission changes (e.g. to a base group like 'everyone') impacting service security.

Issue Links

• is related to: SLING-10324 ServiceUserMapper documentation is incomplete