Uploaded image for project: 'Sling'
  1. Sling
  2. SLING-8604

AclUtil.setAcl: invalid assumptions regarding principal lookup

Attach filesAttach ScreenshotVotersWatch issueWatchersCreate sub-taskLinkCloneUpdate Comment AuthorReplace String in CommentUpdate Comment VisibilityDelete Comments


    • Type: Bug
    • Status: Closed
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: None
    • Fix Version/s: Repoinit JCR 1.1.14
    • Component/s: Repoinit
    • Labels:


      IMHO, AclUtil.setAcl makes the following invalid assumptions about principals:

      1. every principal is backed by a user/group defined by jackrabbit user management (which already is not necessarily true for the everyone group, which was probably the reason for the extra if for everyone)
      2. for those cases where a given principal is in fact associated with an known user/group, the implementation assumes that the principal name is identical to the ID

      for the former it is sufficient to look at the everyone principal or at the synchronization mechanism in oak-auth-external, which defines an additional PrincipalProvider that does not require principals to be reflected as users/goups and for which setting up access control content is equally valid (see also oak-exercise module for a simplistic, custom principal provider to play around with).

      the latter can easily be illustrated by creating a user/group account with a different principal name by calling UserManager.createUser(String, String, Principal, String) or UserManager.createGroup(String, Principal, String.


        Issue Links



            • Assignee:
              rombert Robert Munteanu
              angela Angela Schreiber


              • Created:

                Issue deployment