[SLING-5135] Whitelist legit usages of loginAdministrative and administrative ResourceResolver

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: JCR Base 2.4.2
• Component/s: JCR
• Assignee: Julian Sedding
• Reporter: Antonio Sanso
• Created: 12/Oct/15 07:57
• Updated: 16/Nov/18 10:19
• Resolved: 10/Nov/16 16:17

Description

AbstractSlingRepositoryManager contains a method that disable loginAdministrative support

    /**
     * Returns whether to disable the
     * {@code SlingRepository.loginAdministrative} method or not.
     *
     * @return {@code true} if {@code SlingRepository.loginAdministrative} is
     *         disabled.
     */
    public final boolean isDisableLoginAdministrative() 

This is a global configuration. It would be nice to have an extension of such mechanism that contains a white list of (few) legit usage of loginAdministrative

Issue Links

• is blocked by: SLING-6113 JcrProviderStateFactory needs a reference to the bundle that's using it
• is blocked by: SLING-6124 Update oak-server to latest JCR module snapshots
• is related to: JCRVLT-325 VaultSyncServiceImpl still relies on deprecated loginAdministrative
• relates to: SLING-5355 Create service users and ACLs from the provisioning model
• relates to: SLING-6273 Document SLING-5135 - whitelist of legit login admin uses
• links to: GitHub Pull Request #185