[SLING-6130] Restrict access for principal everyone and move configuration to repoinit

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Done
• Affects Version/s: JCR Oak Server 1.1.0
• Fix Version/s: JCR Oak Server 1.1.4, Karaf Launchpad Integration Tests (Oak Tar) 0.0.12, Karaf Integration Tests 1.0.0, Karaf Configs 1.0.0, Starter 11
• Component/s: JCR, Karaf, Launchpad, Oak
• Labels: Sling-11-ReleaseNotes security
• Assignee: Oliver Lietz
• Reporter: Oliver Lietz
• Created: 11/Oct/16 13:21
• Updated: 23/Oct/18 09:18
• Resolved: 08/Feb/18 16:47

Description

Currently everyone can read from / (configured in OakSlingRepositoryManager).

Access for everyone should be restricted:

• read should be restricted to /content
• configuration of principals and ACLs should be done with repoinit

1. Change path from / to /content in OakSlingRepositoryManager (r1764259)
2. Fix modules (samples) relying on unrestricted read access
3. Move configuration of ACLs to repoinit

discussion on dev@

Issue Links

• blocks: SLING-7647 Anonymous access to content stopped working
• causes: SLING-7615 HTL integration tests should use authentication
• causes: SLING-7721 [HTL] Redirect user to login form in REPL if the user is not already authenticated
• is blocked by: SLING-6171 Unable to set up ACLs for the 'everyone' principal
• relates to: SLING-7554 Link to Slingshot sample does not work
• relates to: SLING-7484 Move content from JCR root to /content