[SLING-4624] Implement Subject-Support for Events, Preprocessors and Jobs

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Won't Fix
• Affects Version/s: Resource Resolver 1.2.4
• Component/s: ResourceResolver
• Assignee: Unassigned
• Reporter: Dominique Jäggi
• Created: 15/Apr/15 09:04
• Updated: 14/Apr/23 13:29
• Resolved: 14/Apr/23 13:29

Description

When processing events or jobs the corresponding session that triggered the event is usually lost. This leads to event handlers and job processors often using administrative sessions to do their work. As per the effort of eliminating all loginAdministrative use, there must be an alternative solution. There preferred approach to solve this problem:

• Pass a serialization of the event-causing Subject in the event payload, and create a ResourceResolver based on that subject (e.g. using JAAS doAsPrivileged in the ResourceResolverFactory).
  • Pros: "Clean" implementation from a security POV. Avoids re-authentication. Operates with the original privileges. Security relevant code transparent to the consumer of the event.
  • Cons: Needs refactoring. Security relevant code transparent to the consumer of the event (might also lead to problems).

Above approach is currently only partially implementable, as repository events may be swallowed due to oak compressing commits upon encountering certain loads, thus eliminating particular events or aggregating an event under a different user than the "sub-event".

Issue Links

• is blocked by: OAK-2772 Make Event Subjects Available in All Cases