[SLING-6963] Service user declaration based on principal names

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: Service User Mapper 1.3.4
• Component/s: Service User Mapper
• Labels: Sling-10-ReleaseNotes
• Assignee: Karl Pauls
• Reporter: Angela Schreiber
• Created: 15/Jun/17 12:33
• Updated: 08/Dec/22 12:30
• Resolved: 10/Jul/17 15:41

Description

Currently SlingRepository.loginService relies on a configuration that maps services/subservices to a single service user by it's name/ID. Heavy usage of this concept over the last years has reveal a couple of findings, we missed when inventing the service user concept:

• it is prone to redundant of permission setup when defining permissions for individual service users that often share common needs while at the same time being responsible for completing distinct special operations (e.g. read-content (common) and write-special-subtree (special operation)
• some services require a combination of different operations reflected by existing groups and we ended up having service users being put into groups in order to avoid permission duplication (ultimately leaving us with somewhat intransparent permission setup for a given service).

Learning from these findings I like would proposed an alternative way of registering service users that would allow for specifying a set of principal names, effectively declaring all tasks a given service is designed to complete. this would allow to re-use existing service users and thus avoid duplication of permission setup for both cases mentioned above.

Also, implementing this alternative mapping would allow to get rid of the double repository login as it is currently present within AbstractSlingRepository2#createServiceSession and as such have a positive impact on performance.

Issue Links

• is depended upon by: SLING-6973 Adjust AbstractSlingRepository2 to reflect SLING-6963
• is depended upon by: SLING-6974 Adjust JcrSystemUserValidator to reflect SLING-6963
• is depended upon by: SLING-6981 Adjust ResourceResolverFactoryImpl and CommonsResourceResolverFactoryImpl to reflect SLING-6963
• is related to: OAK-7952 JCR System users do no longer consider group ACEs of groups they are member of
• is related to: SLING-10324 ServiceUserMapper documentation is incomplete
• is related to: SLING-11723 Expose more authentication information from ResourceResolver
• is related to: SLING-8171 Adjust https://sling.apache.org/documentation/the-sling-engine/service-authentication.html#service-user-mappings to reflect the principal based mapping