org.apache.sling.jcr.resource comes with a JcrSystemUserValidator that adds validation to service-user-mapping and if enable prevents regular users or groups from being mapped.
however, JcrSystemUserValidatorTest doesn't contain a single test case verifying if the validation is actually successful for system users (or that disabled system users would not be valid).
i suspect that this is due to the fact that org.apache.sling.commons.testing.jcr.RepositoryTestBase creates a Jackrabbit repository and has never been adjusted to allow for an Oak repository to be used as test repository. In other words: an attempt to create a system user will fail.
Robert Munteanu, is there an alternative to the RepositoryTestBase that would operate on a Oak repository?