[SLING-8602] Add support for PrincipalAccessControlList and ac-management by principal

• Type: New Feature
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: Repoinit Parser 1.3.0, Repoinit JCR 1.1.14
• Component/s: Repoinit
• Labels: Sling-12-ReleaseNotes
• Assignee: Robert Munteanu
• Reporter: Angela Schreiber
• Created: 31/Jul/19 06:51
• Updated: 30/Sep/19 16:48
• Resolved: 20/Sep/19 08:59

Description

with JCR-4429 comes a new type of JackrabbitAccessControlList that allows to provide native support for access control management by principal as defined by org.apache.jackrabbit.api.security.JackrabbitAccessControlManager.

now that there exists a new authorization model in Oak (OAK-8190) that implements these extensions, it would be desirable if the repo-init would cover access control management by principal.

note: while the original aim of OAK-8190 was to store permissions for system users (aka service users) separately, the implementation in oak-authorization-principalbased is not limited to system users and doesn't mandate the policies to be stored with a user node. the location of the access controlled node is an implementation detail that can be changed. see Jackrabbit API and http://jackrabbit.apache.org/oak/docs/security/authorization/principalbased.html for additional details.

Issue Links

• blocks: SLING-8722 Documentation for SLING-8602 and SLING-8619
• is blocked by: SLING-8619 RepoInitGrammer: Add repository-level marker to pathsList
• is blocked by: SLING-8625 org.apache.sling.testing.sling-mock-oak : update oak version to 1.16.0, jackrabbit version to 2.18.2
• is blocked by: SLING-8627 Update sling-jcr-repoinit to Oak 1.16.0 and Jackrabbit 2.18.2
• is related to: SLING-8617 GeneralAclTest: test session should be refreshed to reflect latest changes
• is related to: SLING-8604 AclUtil.setAcl: invalid assumptions regarding principal lookup
• is related to: SLING-8605 AclUtil.createLocalRestrictions should use JackrabbitAccessControlList.isMultiValueRestriction(String)
• is related to: SLING-8621 TestUtil.cleanup causes in WARNing due to SlingContext Rule