Index: oak-core/src/main/java/org/apache/jackrabbit/oak/Oak.java
===================================================================
--- oak-core/src/main/java/org/apache/jackrabbit/oak/Oak.java	(revision 1447679)
+++ oak-core/src/main/java/org/apache/jackrabbit/oak/Oak.java	(revision )
@@ -21,6 +21,8 @@
 import javax.jcr.NoSuchWorkspaceException;
 import javax.security.auth.login.LoginException;
 
+import com.google.common.base.Function;
+import com.google.common.collect.Iterables;
 import org.apache.jackrabbit.mk.api.MicroKernel;
 import org.apache.jackrabbit.mk.core.MicroKernelImpl;
 import org.apache.jackrabbit.oak.api.ContentRepository;
@@ -42,6 +44,7 @@
 import org.apache.jackrabbit.oak.spi.lifecycle.CompositeInitializer;
 import org.apache.jackrabbit.oak.spi.lifecycle.OakInitializer;
 import org.apache.jackrabbit.oak.spi.lifecycle.RepositoryInitializer;
+import org.apache.jackrabbit.oak.spi.lifecycle.WorkspaceInitializer;
 import org.apache.jackrabbit.oak.spi.query.CompositeQueryIndexProvider;
 import org.apache.jackrabbit.oak.spi.query.QueryIndexProvider;
 import org.apache.jackrabbit.oak.spi.security.OpenSecurityProvider;
@@ -231,12 +234,26 @@
 
         commitHooks.add(IndexHookManager.of(indexHooks));
         withValidatorHook();
+        CommitHook commitHook = CompositeHook.compose(commitHooks);
+        QueryIndexProvider indexProvider = CompositeQueryIndexProvider.compose(queryIndexProviders);
 
+        // FIXME: move to proper workspace initialization
+        // initialize default workspace
+        Iterable<WorkspaceInitializer> workspaceInitializers =
+                Iterables.transform(securityProvider.getSecurityConfigurations(),
+                        new Function<SecurityConfiguration, WorkspaceInitializer>() {
+            @Override
+            public WorkspaceInitializer apply(SecurityConfiguration sc) {
+                return sc.getWorkspaceInitializer();
+            }
+        });
+        OakInitializer.initialize(workspaceInitializers, store, defaultWorkspaceName, indexHooks, indexProvider, commitHook);
+
         return new ContentRepositoryImpl(
                 store,
-                CompositeHook.compose(commitHooks),
+                commitHook,
                 defaultWorkspaceName,
-                CompositeQueryIndexProvider.compose(queryIndexProviders),
+                indexProvider,
                 securityProvider);
     }
 
Index: oak-core/src/main/java/org/apache/jackrabbit/oak/security/user/UserConfigurationImpl.java
===================================================================
--- oak-core/src/main/java/org/apache/jackrabbit/oak/security/user/UserConfigurationImpl.java	(revision 1447679)
+++ oak-core/src/main/java/org/apache/jackrabbit/oak/security/user/UserConfigurationImpl.java	(revision )
@@ -26,7 +26,7 @@
 import org.apache.jackrabbit.oak.spi.commit.CommitHook;
 import org.apache.jackrabbit.oak.spi.commit.CommitHookProvider;
 import org.apache.jackrabbit.oak.spi.commit.ValidatingHook;
-import org.apache.jackrabbit.oak.spi.lifecycle.RepositoryInitializer;
+import org.apache.jackrabbit.oak.spi.lifecycle.WorkspaceInitializer;
 import org.apache.jackrabbit.oak.spi.security.ConfigurationParameters;
 import org.apache.jackrabbit.oak.spi.security.Context;
 import org.apache.jackrabbit.oak.spi.security.SecurityConfiguration;
@@ -61,7 +61,7 @@
 
     @Nonnull
     @Override
-    public RepositoryInitializer getRepositoryInitializer() {
+    public WorkspaceInitializer getWorkspaceInitializer() {
         return new UserInitializer(securityProvider);
     }
 
Index: oak-core/src/main/java/org/apache/jackrabbit/oak/spi/lifecycle/OakInitializer.java
===================================================================
--- oak-core/src/main/java/org/apache/jackrabbit/oak/spi/lifecycle/OakInitializer.java	(revision 1447679)
+++ oak-core/src/main/java/org/apache/jackrabbit/oak/spi/lifecycle/OakInitializer.java	(revision )
@@ -18,17 +18,22 @@
  */
 package org.apache.jackrabbit.oak.spi.lifecycle;
 
+import javax.annotation.Nonnull;
+
 import org.apache.jackrabbit.oak.api.CommitFailedException;
 import org.apache.jackrabbit.oak.plugins.index.IndexHookManager;
 import org.apache.jackrabbit.oak.plugins.index.IndexHookProvider;
+import org.apache.jackrabbit.oak.spi.commit.CommitHook;
+import org.apache.jackrabbit.oak.spi.query.QueryIndexProvider;
 import org.apache.jackrabbit.oak.spi.state.NodeState;
 import org.apache.jackrabbit.oak.spi.state.NodeStore;
 import org.apache.jackrabbit.oak.spi.state.NodeStoreBranch;
 
 public class OakInitializer {
 
-    public static void initialize(NodeStore store,
-            RepositoryInitializer initializer, IndexHookProvider indexHook) {
+    public static void initialize(@Nonnull NodeStore store,
+                                  @Nonnull RepositoryInitializer initializer,
+                                  @Nonnull IndexHookProvider indexHook) {
         NodeStoreBranch branch = store.branch();
         NodeState before = branch.getRoot();
         branch.setRoot(initializer.initialize(before));
@@ -39,4 +44,22 @@
         }
     }
 
+    public static void initialize(@Nonnull Iterable<WorkspaceInitializer> initializer,
+                                  @Nonnull NodeStore store,
+                                  @Nonnull String workspaceName,
+                                  @Nonnull IndexHookProvider indexHook,
+                                  @Nonnull QueryIndexProvider indexProvider,
+                                  @Nonnull CommitHook commitHook) {
+        NodeStoreBranch branch = store.branch();
+        NodeState root = branch.getRoot();
+        for (WorkspaceInitializer wspInit : initializer) {
+            root = wspInit.initialize(root, workspaceName, indexHook, indexProvider, commitHook);
-}
+        }
+        branch.setRoot(root);
+        try {
+            branch.merge(IndexHookManager.of(indexHook));
+        } catch (CommitFailedException e) {
+            throw new RuntimeException(e);
+        }
+    }
+}
Index: oak-core/src/main/java/org/apache/jackrabbit/oak/spi/security/SecurityConfiguration.java
===================================================================
--- oak-core/src/main/java/org/apache/jackrabbit/oak/spi/security/SecurityConfiguration.java	(revision 1447679)
+++ oak-core/src/main/java/org/apache/jackrabbit/oak/spi/security/SecurityConfiguration.java	(revision )
@@ -22,9 +22,14 @@
 
 import org.apache.jackrabbit.oak.api.PropertyState;
 import org.apache.jackrabbit.oak.api.Tree;
+import org.apache.jackrabbit.oak.plugins.index.IndexHookProvider;
+import org.apache.jackrabbit.oak.spi.commit.CommitHook;
 import org.apache.jackrabbit.oak.spi.commit.CommitHookProvider;
 import org.apache.jackrabbit.oak.spi.lifecycle.CompositeInitializer;
 import org.apache.jackrabbit.oak.spi.lifecycle.RepositoryInitializer;
+import org.apache.jackrabbit.oak.spi.lifecycle.WorkspaceInitializer;
+import org.apache.jackrabbit.oak.spi.query.QueryIndexProvider;
+import org.apache.jackrabbit.oak.spi.state.NodeState;
 import org.apache.jackrabbit.oak.spi.xml.ProtectedItemImporter;
 
 /**
@@ -39,6 +44,9 @@
     RepositoryInitializer getRepositoryInitializer();
 
     @Nonnull
+    WorkspaceInitializer getWorkspaceInitializer();
+
+    @Nonnull
     CommitHookProvider getSecurityHooks();
 
     @Nonnull
@@ -69,6 +77,18 @@
 
         @Nonnull
         @Override
+        public WorkspaceInitializer getWorkspaceInitializer() {
+            return new WorkspaceInitializer() {
+                @Nonnull
+                @Override
+                public NodeState initialize(NodeState workspaceRoot, String workspaceName, IndexHookProvider indexHook, QueryIndexProvider indexProvider, CommitHook commitHook) {
+                    return workspaceRoot;
+                }
+            };
+        }
+
+        @Nonnull
+        @Override
         public CommitHookProvider getSecurityHooks() {
             return new CommitHookProvider.Empty();
         }
Index: oak-core/src/main/java/org/apache/jackrabbit/oak/security/user/UserInitializer.java
===================================================================
--- oak-core/src/main/java/org/apache/jackrabbit/oak/security/user/UserInitializer.java	(revision 1447679)
+++ oak-core/src/main/java/org/apache/jackrabbit/oak/security/user/UserInitializer.java	(revision )
@@ -16,6 +16,7 @@
  */
 package org.apache.jackrabbit.oak.security.user;
 
+import javax.annotation.Nonnull;
 import javax.jcr.RepositoryException;
 
 import org.apache.jackrabbit.JcrConstants;
@@ -26,11 +27,13 @@
 import org.apache.jackrabbit.oak.namepath.NamePathMapper;
 import org.apache.jackrabbit.oak.plugins.index.IndexConstants;
 import org.apache.jackrabbit.oak.plugins.index.IndexHookManager;
+import org.apache.jackrabbit.oak.plugins.index.IndexHookProvider;
 import org.apache.jackrabbit.oak.plugins.index.IndexUtils;
-import org.apache.jackrabbit.oak.plugins.index.p2.Property2IndexHookProvider;
-import org.apache.jackrabbit.oak.plugins.index.p2.Property2IndexProvider;
 import org.apache.jackrabbit.oak.plugins.memory.MemoryNodeStore;
-import org.apache.jackrabbit.oak.spi.lifecycle.RepositoryInitializer;
+import org.apache.jackrabbit.oak.security.authentication.SystemSubject;
+import org.apache.jackrabbit.oak.spi.commit.CommitHook;
+import org.apache.jackrabbit.oak.spi.lifecycle.WorkspaceInitializer;
+import org.apache.jackrabbit.oak.spi.query.QueryIndexProvider;
 import org.apache.jackrabbit.oak.spi.security.SecurityProvider;
 import org.apache.jackrabbit.oak.spi.security.user.UserConfiguration;
 import org.apache.jackrabbit.oak.spi.security.user.UserConstants;
@@ -41,7 +44,7 @@
 import org.slf4j.LoggerFactory;
 
 /**
- * Creates initial set of users to be present in the repository. This
+ * Creates initial set of users to be present in a given workspace. This
  * implementation uses the {@code UserManager} such as defined by the
  * user configuration.
  * <p/>
@@ -64,7 +67,7 @@
  * <li>{@link UserConstants#REP_MEMBERS}</li>
  * </ul>
  */
-public class UserInitializer implements RepositoryInitializer, UserConstants {
+public class UserInitializer implements WorkspaceInitializer, UserConstants {
 
     /**
      * logger instance
@@ -77,22 +80,26 @@
         this.securityProvider = securityProvider;
     }
 
-    //----------------------------------------------< RepositoryInitializer >---
+    //-----------------------------------------------< WorkspaceInitializer >---
+    @Nonnull
     @Override
-    public NodeState initialize(NodeState state) {
+    public NodeState initialize(NodeState workspaceRoot, String workspaceName,
+                                IndexHookProvider indexHook, QueryIndexProvider indexProvider,
+                                CommitHook commitHook) {
         MemoryNodeStore store = new MemoryNodeStore();
         NodeStoreBranch branch = store.branch();
-        branch.setRoot(state);
+        branch.setRoot(workspaceRoot);
         try {
-            branch.merge(IndexHookManager.of(new Property2IndexHookProvider()));
+            branch.merge(IndexHookManager.of(indexHook));
         } catch (CommitFailedException e) {
             throw new RuntimeException(e);
         }
-        Root root = new RootImpl(store, new Property2IndexProvider());
+        Root root = new RootImpl(store, commitHook, workspaceName, SystemSubject.INSTANCE, securityProvider, indexProvider);
 
         UserConfiguration userConfiguration = securityProvider.getUserConfiguration();
         UserManager userManager = userConfiguration.getUserManager(root, NamePathMapper.DEFAULT);
 
+        String errorMsg = "Failed to initialize user content.";
         try {
             NodeUtil rootTree = new NodeUtil(root.getTree("/"));
             NodeUtil index = rootTree.getOrAddChild(IndexConstants.INDEX_DEFINITIONS_NAME, JcrConstants.NT_UNSTRUCTURED);
@@ -115,10 +122,10 @@
                 root.commit();
             }
         } catch (RepositoryException e) {
-            log.error("Failed to initialize user content ", e);
+            log.error(errorMsg, e);
             throw new RuntimeException(e);
         } catch (CommitFailedException e) {
-            log.error("Failed to initialize user content ", e);
+            log.error(errorMsg, e);
             throw new RuntimeException(e);
         }
         return store.getRoot();
Index: oak-core/src/main/java/org/apache/jackrabbit/oak/spi/lifecycle/WorkspaceInitializer.java
===================================================================
--- oak-core/src/main/java/org/apache/jackrabbit/oak/spi/lifecycle/WorkspaceInitializer.java	(revision )
+++ oak-core/src/main/java/org/apache/jackrabbit/oak/spi/lifecycle/WorkspaceInitializer.java	(revision )
@@ -0,0 +1,48 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.jackrabbit.oak.spi.lifecycle;
+
+import javax.annotation.Nonnull;
+
+import org.apache.jackrabbit.oak.plugins.index.IndexHookProvider;
+import org.apache.jackrabbit.oak.spi.commit.CommitHook;
+import org.apache.jackrabbit.oak.spi.query.QueryIndexProvider;
+import org.apache.jackrabbit.oak.spi.state.NodeState;
+
+/**
+ * Initializer of a workspace and it's initial content. A module that needs
+ * to add content to a new workspace upon creation can implement this interface.
+ * Any configured initializer will be invoked once a new workspace is being
+ * created.
+ */
+public interface WorkspaceInitializer {
+
+    /**
+     * Initialize the content of a new workspace. This method is called before
+     * the workspace becomes available.
+     *
+     * @param workspaceRoot The workspace root state.
+     * @param workspaceName The name of the workspace that is being initialized.
+     * @param indexHook
+     * @param commitHook
+     * @return The modified workspace root state.
+     */
+    @Nonnull
+    NodeState initialize(NodeState workspaceRoot, String workspaceName,
+                         IndexHookProvider indexHook, QueryIndexProvider indexProvider,
+                         CommitHook commitHook);
+}
\ No newline at end of file
