Index: oak-jackrabbit-api/src/main/java/org/apache/jackrabbit/api/security/user/Authorizable.java
IDEA additional info:
Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
<+>UTF-8
===================================================================
--- oak-jackrabbit-api/src/main/java/org/apache/jackrabbit/api/security/user/Authorizable.java	(revision 1865297)
+++ oak-jackrabbit-api/src/main/java/org/apache/jackrabbit/api/security/user/Authorizable.java	(date 1565949114000)
@@ -16,6 +16,9 @@
  */
 package org.apache.jackrabbit.api.security.user;
 
+import org.jetbrains.annotations.NotNull;
+import org.jetbrains.annotations.Nullable;
+
 import java.security.Principal;
 import java.util.Iterator;
 
@@ -65,6 +68,7 @@
      * @return Name of this <code>Authorizable</code>.
      * @throws RepositoryException if an error occurs.
      */
+    @NotNull
     String getID() throws RepositoryException;
 
     /**
@@ -76,12 +80,14 @@
      * @return a representation as Principal.
      * @throws RepositoryException If an error occurs.
      */
+    @NotNull
     Principal getPrincipal() throws RepositoryException;
 
     /**
      * @return all {@link Group}s, this Authorizable is declared member of.
      * @throws RepositoryException If an error occurs.
      */
+    @NotNull
     Iterator<Group> declaredMemberOf() throws RepositoryException;
 
     /**
@@ -89,6 +95,7 @@
      *         indirect group membership.
      * @throws RepositoryException If an error occurs.
      */
+    @NotNull
     Iterator<Group> memberOf() throws RepositoryException;
 
     /**
@@ -114,6 +121,7 @@
      * name.
      * @see #hasProperty(String)
      */
+    @NotNull
     Iterator<String> getPropertyNames() throws RepositoryException;
 
     /**
@@ -126,7 +134,8 @@
      * @see #getProperty(String)
      * @see #hasProperty(String)
      */
-    Iterator<String> getPropertyNames(String relPath) throws RepositoryException;
+    @NotNull
+    Iterator<String> getPropertyNames(@NotNull String relPath) throws RepositoryException;
 
     /**
      * Tests if a the property with specified name exists.
@@ -136,7 +145,7 @@
      * @throws RepositoryException If an error occurs.
      * @see #getProperty(String)
      */
-    boolean hasProperty(String relPath) throws RepositoryException;
+    boolean hasProperty(@NotNull String relPath) throws RepositoryException;
 
     /**
      * Set an arbitrary property to this <code>Authorizable</code>.
@@ -145,7 +154,7 @@
      * @param value The desired value.
      * @throws RepositoryException If the specified property could not be set.
      */
-    void setProperty(String relPath, Value value) throws RepositoryException;
+    void setProperty(@NotNull String relPath, @Nullable Value value) throws RepositoryException;
 
     /**
      * Set an arbitrary property to this <code>Authorizable</code>.
@@ -154,7 +163,7 @@
      * @param value The desired property values.
      * @throws RepositoryException If the specified property could not be set.
      */
-    void setProperty(String relPath, Value[] value) throws RepositoryException;
+    void setProperty(@NotNull String relPath, @Nullable Value[] value) throws RepositoryException;
 
     /**
      * Returns the values for the properties with the specified name or
@@ -165,7 +174,8 @@
      *         if no such property exists.
      * @throws RepositoryException If an error occurs.
      */
-    Value[] getProperty(String relPath) throws RepositoryException;
+    @Nullable
+    Value[] getProperty(@NotNull String relPath) throws RepositoryException;
 
     /**
      * Removes the property with the given name.
@@ -175,7 +185,7 @@
      *         removed; false if no such property was present.
      * @throws RepositoryException If an error occurs.
      */
-    boolean removeProperty(String relPath) throws RepositoryException;
+    boolean removeProperty(@NotNull String relPath) throws RepositoryException;
 
     /**
      * Returns a JCR path if this authorizable instance is associated with an
@@ -196,5 +206,6 @@
      * @throws RepositoryException If an error occurs while retrieving the
      * <code>Item</code> path.
      */
+    @NotNull
     String getPath() throws UnsupportedRepositoryOperationException, RepositoryException;
 }
Index: oak-jackrabbit-api/src/main/java/org/apache/jackrabbit/api/security/user/Group.java
IDEA additional info:
Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
<+>UTF-8
===================================================================
--- oak-jackrabbit-api/src/main/java/org/apache/jackrabbit/api/security/user/Group.java	(revision 1865297)
+++ oak-jackrabbit-api/src/main/java/org/apache/jackrabbit/api/security/user/Group.java	(date 1565949114000)
@@ -34,6 +34,7 @@
      * members of this Group.
      * @throws RepositoryException If an error occurs.
      */
+    @NotNull
     Iterator<Authorizable> getDeclaredMembers() throws RepositoryException;
 
     /**
@@ -42,6 +43,7 @@
      * that are indirect group members.
      * @throws RepositoryException If an error occurs.
      */
+    @NotNull
     Iterator<Authorizable> getMembers() throws RepositoryException;
 
     /**
@@ -50,7 +52,7 @@
      * @return  <code>true</code> if the Authorizable to test is a direct member
      * @throws RepositoryException  If an error occurs.
      */
-    boolean isDeclaredMember(Authorizable authorizable) throws RepositoryException;
+    boolean isDeclaredMember(@NotNull Authorizable authorizable) throws RepositoryException;
     
     /**
      * @param authorizable The <code>Authorizable</code> to test.
@@ -58,7 +60,7 @@
      * of this Group.
      * @throws RepositoryException If an error occurs.
      */
-    boolean isMember(Authorizable authorizable) throws RepositoryException;
+    boolean isMember(@NotNull Authorizable authorizable) throws RepositoryException;
 
     /**
      * Add a member to this Group.
@@ -71,7 +73,7 @@
      * group itself or for some implementation specific constraint).
      * @throws RepositoryException If an error occurs.
      */
-    boolean addMember(Authorizable authorizable) throws RepositoryException;
+    boolean addMember(@NotNull Authorizable authorizable) throws RepositoryException;
 
     /**
      * Add one or more member(s) to this Group. Note, that an implementation may
@@ -89,6 +91,7 @@
      * @throws RepositoryException If one of the specified memberIds is invalid or
      * if some other error occurs.
      */
+    @NotNull
     Set<String> addMembers(@NotNull String... memberIds) throws RepositoryException;
 
     /**
@@ -99,7 +102,7 @@
      * @return true if the Authorizable was successfully removed. False otherwise.
      * @throws RepositoryException If an error occurs.
      */
-    boolean removeMember(Authorizable authorizable) throws RepositoryException;
+    boolean removeMember(@NotNull Authorizable authorizable) throws RepositoryException;
 
     /**
      * Remove one or several members from this Group. Note, that an implementation
@@ -115,5 +118,6 @@
      * @throws RepositoryException If one of the specified memberIds is invalid
      * or if some other error occurs.
      */
+    @NotNull
     Set<String> removeMembers(@NotNull String... memberIds) throws RepositoryException;
 }
Index: oak-jackrabbit-api/src/main/java/org/apache/jackrabbit/api/security/user/Impersonation.java
IDEA additional info:
Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
<+>UTF-8
===================================================================
--- oak-jackrabbit-api/src/main/java/org/apache/jackrabbit/api/security/user/Impersonation.java	(revision 1865297)
+++ oak-jackrabbit-api/src/main/java/org/apache/jackrabbit/api/security/user/Impersonation.java	(date 1565949732000)
@@ -17,6 +17,8 @@
 package org.apache.jackrabbit.api.security.user;
 
 import org.apache.jackrabbit.api.security.principal.PrincipalIterator;
+import org.jetbrains.annotations.NotNull;
+import org.jetbrains.annotations.Nullable;
 
 import javax.jcr.RepositoryException;
 import javax.security.auth.Subject;
@@ -38,6 +40,7 @@
      * object has been created for.
      * @throws RepositoryException If an error occurs.
      */
+    @NotNull
     PrincipalIterator getImpersonators() throws RepositoryException;
 
     /**
@@ -48,7 +51,7 @@
      * granted to it, false otherwise.
      * @throws RepositoryException If an error occurs.
      */
-    boolean grantImpersonation(Principal principal) throws RepositoryException;
+    boolean grantImpersonation(@NotNull Principal principal) throws RepositoryException;
 
     /**
      * @param principal The principal that should no longer be allowed to
@@ -57,7 +60,7 @@
      * the given principal; false otherwise.
      * @throws RepositoryException If an error occurs.
      */
-    boolean revokeImpersonation(Principal principal) throws RepositoryException;
+    boolean revokeImpersonation(@NotNull Principal principal) throws RepositoryException;
 
     /**
      * Test if the given subject (i.e. any of the principals it contains) is
@@ -68,5 +71,5 @@
      * Subject to impersonate.
      * @throws RepositoryException If an error occurs.
      */
-    boolean allows(Subject subject) throws RepositoryException;
+    boolean allows(@NotNull Subject subject) throws RepositoryException;
 }
Index: oak-jackrabbit-api/src/main/java/org/apache/jackrabbit/api/security/user/package-info.java
IDEA additional info:
Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
<+>UTF-8
===================================================================
--- oak-jackrabbit-api/src/main/java/org/apache/jackrabbit/api/security/user/package-info.java	(revision 1865297)
+++ oak-jackrabbit-api/src/main/java/org/apache/jackrabbit/api/security/user/package-info.java	(date 1565957340000)
@@ -18,5 +18,5 @@
 /**
  * Jackrabbit extensions for user management.
  */
-@org.osgi.annotation.versioning.Version("2.4.2")
+@org.osgi.annotation.versioning.Version("2.4.3")
 package org.apache.jackrabbit.api.security.user;
Index: oak-jackrabbit-api/src/main/java/org/apache/jackrabbit/api/security/user/Query.java
IDEA additional info:
Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
<+>UTF-8
===================================================================
--- oak-jackrabbit-api/src/main/java/org/apache/jackrabbit/api/security/user/Query.java	(revision 1865297)
+++ oak-jackrabbit-api/src/main/java/org/apache/jackrabbit/api/security/user/Query.java	(date 1565950043000)
@@ -17,6 +17,8 @@
 
 package org.apache.jackrabbit.api.security.user;
 
+import org.jetbrains.annotations.NotNull;
+
 /**
  * A query to match {@link Authorizable}s. Pass an instance of this interface to
  * {@link UserManager#findAuthorizables(Query)}.
@@ -46,5 +48,5 @@
      * @param builder  A query builder for building the query.
      * @param <T>  Opaque type of the query builder.
      */
-    <T> void build(QueryBuilder<T> builder);
+    <T> void build(@NotNull QueryBuilder<T> builder);
 }
Index: oak-jackrabbit-api/src/main/java/org/apache/jackrabbit/api/security/user/QueryBuilder.java
IDEA additional info:
Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
<+>UTF-8
===================================================================
--- oak-jackrabbit-api/src/main/java/org/apache/jackrabbit/api/security/user/QueryBuilder.java	(revision 1865297)
+++ oak-jackrabbit-api/src/main/java/org/apache/jackrabbit/api/security/user/QueryBuilder.java	(date 1565949114000)
@@ -17,6 +17,9 @@
 
 package org.apache.jackrabbit.api.security.user;
 
+import org.jetbrains.annotations.NotNull;
+import org.jetbrains.annotations.Nullable;
+
 import javax.jcr.Value;
 
 public interface QueryBuilder<T> {
@@ -45,7 +48,7 @@
      *
      * @param selector  The selector for the query
      */
-    void setSelector(Class<? extends Authorizable> selector);
+    void setSelector(@NotNull Class<? extends Authorizable> selector);
 
     /**
      * Set the scope for the query. If set, the query will only return members of a specific group.
@@ -54,7 +57,7 @@
      * @param declaredOnly  If <code>true</code> only declared members of the groups are returned.
      * Otherwise indirect memberships are also considered. 
      */
-    void setScope(String groupName, boolean declaredOnly);
+    void setScope(@NotNull String groupName, boolean declaredOnly);
 
     /**
      * Set the condition for the query. The query only includes {@link Authorizable}s
@@ -62,7 +65,7 @@
      * 
      * @param condition  Condition upon which <code>Authorizables</code> are included in the query result
      */
-    void setCondition(T condition);
+    void setCondition(@NotNull T condition);
 
     /**
      * Set the sort order of the {@link Authorizable}s returned by the query.
@@ -76,7 +79,7 @@
      * @param ignoreCase  Ignore character case in sort if <code>true</code>. Note: For <code>false</code>
      * sorting is done lexicographically even for non string properties.
      */
-    void setSortOrder(String propertyName, Direction direction, boolean ignoreCase);
+    void setSortOrder(@NotNull String propertyName, @NotNull Direction direction, boolean ignoreCase);
 
     /**
      * Set the sort order of the {@link Authorizable}s returned by the query.
@@ -88,7 +91,7 @@
      * @param propertyName  The name of the property to sort on
      * @param direction  Direction to sort. Either {@link Direction#ASCENDING} or {@link Direction#DESCENDING}
      */
-    void setSortOrder(String propertyName, Direction direction); 
+    void setSortOrder(@NotNull String propertyName, @NotNull Direction direction);
 
     /**
      * Set limits for the query. The limits consists of a bound and a maximal
@@ -102,7 +105,7 @@
      * for no bound
      * @param maxCount  Maximal number of results to return. -1 for no limit.
      */
-    void setLimit(Value bound, long maxCount);
+    void setLimit(@Nullable Value bound, long maxCount);
 
     /**
      * Set limits for the query. The limits consists of an offset and a maximal
@@ -129,7 +132,8 @@
      * @param pattern Pattern to match the name of an authorizable.
      * @return  A condition
      */
-    T nameMatches(String pattern);
+    @NotNull
+    T nameMatches(@NotNull String pattern);
 
     /**
      * Create a condition which holds if the node of an {@link Authorizable} has a
@@ -142,7 +146,8 @@
      * @param value  Value to compare the property at <code>relPath</code> to
      * @return  A condition
      */
-    T neq(String relPath, Value value);
+    @NotNull
+    T neq(@NotNull String relPath, @NotNull Value value);
 
     /**
      * Create a condition which holds if the node of an {@link Authorizable} has a
@@ -155,7 +160,8 @@
      * @param value  Value to compare the property at <code>relPath</code> to
      * @return  A condition
      */
-    T eq(String relPath, Value value);
+    @NotNull
+    T eq(@NotNull String relPath, @NotNull Value value);
 
     /**
      * Create a condition which holds if the node of an {@link Authorizable} has a
@@ -168,7 +174,8 @@
      * @param value  Value to compare the property at <code>relPath</code> to
      * @return  A condition
      */
-    T lt(String relPath, Value value);
+    @NotNull
+    T lt(@NotNull String relPath, @NotNull Value value);
 
     /**
      * Create a condition which holds if the node of an {@link Authorizable} has a
@@ -181,7 +188,8 @@
      * @param value  Value to compare the property at <code>relPath</code> to
      * @return  A condition
      */
-    T le(String relPath, Value value);
+    @NotNull
+    T le(@NotNull String relPath, @NotNull Value value);
 
     /**
      * Create a condition which holds if the node of an {@link Authorizable} has a
@@ -194,7 +202,8 @@
      * @param value  Value to compare the property at <code>relPath</code> to
      * @return  A condition
      */
-    T gt(String relPath, Value value);
+    @NotNull
+    T gt(@NotNull String relPath, @NotNull Value value);
 
     /**
      * Create a condition which holds if the node of an {@link Authorizable} has a
@@ -207,7 +216,8 @@
      * @param value  Value to compare the property at <code>relPath</code> to
      * @return  A condition
      */
-    T ge(String relPath, Value value);
+    @NotNull
+    T ge(@NotNull String relPath, @NotNull Value value);
 
     /**
      * Create a condition which holds if the node of an {@link Authorizable} has a
@@ -219,7 +229,8 @@
      * @param relPath  Relative path from the authorizable's node to the property
      * @return  A condition
      */
-    T exists(String relPath);
+    @NotNull
+    T exists(@NotNull String relPath);
 
     /**
      * Create a condition which holds if the node of an {@link Authorizable} has a
@@ -235,7 +246,8 @@
      * @param pattern  Pattern to match the property at <code>relPath</code> against
      * @return  A condition
      */
-    T like(String relPath, String pattern);
+    @NotNull
+    T like(@NotNull String relPath, @NotNull String pattern);
 
     /**
      * Create a full text search condition. The condition holds if the node of an
@@ -253,7 +265,8 @@
      * @param searchExpr  A full text search expression
      * @return  A condition
      */
-    T contains(String relPath, String searchExpr);
+    @NotNull
+    T contains(@NotNull String relPath, @NotNull String searchExpr);
 
     /**
      * Create a condition which holds for {@link Authorizable}s which can impersonate as
@@ -262,7 +275,8 @@
      * @param name  Name of an authorizable
      * @return  A condition
      */
-    T impersonates(String name);
+    @NotNull
+    T impersonates(@NotNull String name);
 
     /**
      * Return a condition which holds if <code>condition</code> does not hold.
@@ -270,7 +284,8 @@
      * @param condition  Condition to negate
      * @return  A condition
      */
-    T not(T condition);
+    @NotNull
+    T not(@NotNull T condition);
 
     /**
      * Return a condition which holds if both sub conditions hold.
@@ -279,7 +294,8 @@
      * @param condition2  second sub condition
      * @return  A condition
      */
-    T and(T condition1, T condition2);
+    @NotNull
+    T and(@NotNull T condition1, @NotNull T condition2);
 
     /**
      * Return a condition which holds if any of the two sub conditions hold.
@@ -288,5 +304,6 @@
      * @param condition2  second sub condition
      * @return  A condition
      */
-    T or(T condition1, T condition2);
+    @NotNull
+    T or(@NotNull T condition1, @NotNull T condition2);
 }
Index: oak-jackrabbit-api/src/main/java/org/apache/jackrabbit/api/security/user/User.java
IDEA additional info:
Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
<+>UTF-8
===================================================================
--- oak-jackrabbit-api/src/main/java/org/apache/jackrabbit/api/security/user/User.java	(revision 1865297)
+++ oak-jackrabbit-api/src/main/java/org/apache/jackrabbit/api/security/user/User.java	(date 1565949115000)
@@ -16,6 +16,9 @@
  */
 package org.apache.jackrabbit.api.security.user;
 
+import org.jetbrains.annotations.NotNull;
+import org.jetbrains.annotations.Nullable;
+
 import javax.jcr.RepositoryException;
 import javax.jcr.Credentials;
 
@@ -47,12 +50,14 @@
      * @return <code>Credentials</code> for this user.
      * @throws javax.jcr.RepositoryException If an error occurs.
      */
+    @NotNull
     Credentials getCredentials() throws RepositoryException;
 
     /**
      * @return <code>Impersonation</code> for this <code>User</code>.
      * @throws javax.jcr.RepositoryException If an error occurs.
      */
+    @NotNull
     Impersonation getImpersonation() throws RepositoryException;
 
     /**
@@ -61,7 +66,7 @@
      * @param password The new password.
      * @throws RepositoryException If an error occurs.
      */
-    void changePassword(String password) throws RepositoryException;
+    void changePassword(@Nullable String password) throws RepositoryException;
 
     /**
      * Change the password of this user.
@@ -71,7 +76,7 @@
      * @throws RepositoryException If the old password doesn't match or if
      * an error occurs.
      */
-    void changePassword(String password, String oldPassword) throws RepositoryException;
+    void changePassword(@Nullable String password, @NotNull String oldPassword) throws RepositoryException;
 
     /**
      * Disable this user thus preventing future login if the <code>reason</code>
@@ -83,7 +88,7 @@
      * <code>null</code> if the user account should be enabled again.
      * @throws RepositoryException If an error occurs.
      */
-    void disable(String reason) throws RepositoryException;
+    void disable(@Nullable String reason) throws RepositoryException;
 
     /**
      * Returns <code>true</code> if this user is disabled, <code>false</code>
@@ -103,5 +108,6 @@
      * if this user is not disabled.
      * @throws RepositoryException If an error occurs.
      */
+    @Nullable
     String getDisabledReason() throws RepositoryException;
 }
Index: oak-jackrabbit-api/src/main/java/org/apache/jackrabbit/api/security/user/UserManager.java
IDEA additional info:
Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
<+>UTF-8
===================================================================
--- oak-jackrabbit-api/src/main/java/org/apache/jackrabbit/api/security/user/UserManager.java	(revision 1865297)
+++ oak-jackrabbit-api/src/main/java/org/apache/jackrabbit/api/security/user/UserManager.java	(date 1565957340000)
@@ -23,6 +23,8 @@
 import javax.jcr.Session;
 import javax.jcr.UnsupportedRepositoryOperationException;
 
+import org.jetbrains.annotations.NotNull;
+import org.jetbrains.annotations.Nullable;
 import org.osgi.annotation.versioning.ProviderType;
 
 /**
@@ -68,7 +70,8 @@
      * @throws RepositoryException If an error occurs.
      * @see Authorizable#getID()
      */
-    Authorizable getAuthorizable(String id) throws RepositoryException;
+    @Nullable
+    Authorizable getAuthorizable(@NotNull String id) throws RepositoryException;
 
     /**
      * Get the Authorizable of a specific type by its id.
@@ -80,7 +83,8 @@
      * @throws AuthorizableTypeException If an authorizable exists but is not of the requested type.
      * @throws RepositoryException If an error occurs
      */
-    <T extends Authorizable> T getAuthorizable(String id, Class<T> authorizableClass) throws AuthorizableTypeException, RepositoryException;
+    @Nullable
+    <T extends Authorizable> T getAuthorizable(@NotNull String id, @NotNull Class<T> authorizableClass) throws AuthorizableTypeException, RepositoryException;
 
     /**
      * Get the Authorizable by its Principal.
@@ -89,7 +93,8 @@
      * @return Authorizable or <code>null</code>, if not present.
      * @throws RepositoryException If an error occurs.
      */
-    Authorizable getAuthorizable(Principal principal) throws RepositoryException;
+    @Nullable
+    Authorizable getAuthorizable(@NotNull Principal principal) throws RepositoryException;
 
     /**
      * In accordance to {@link org.apache.jackrabbit.api.security.user.Authorizable#getPath()}
@@ -102,7 +107,8 @@
      * @throws RepositoryException If another error occurs.
      * @see org.apache.jackrabbit.api.security.user.Authorizable#getPath()
      */
-    Authorizable getAuthorizableByPath(String path) throws UnsupportedRepositoryOperationException, RepositoryException;
+    @Nullable
+    Authorizable getAuthorizableByPath(@NotNull String path) throws UnsupportedRepositoryOperationException, RepositoryException;
 
     /**
      * Returns all <code>Authorizable</code>s that have a
@@ -121,7 +127,8 @@
      * @throws RepositoryException If an error occurs.
      * @see Authorizable#getProperty(String)
      */
-    Iterator<Authorizable> findAuthorizables(String relPath, String value) throws RepositoryException;
+    @NotNull
+    Iterator<Authorizable> findAuthorizables(@NotNull String relPath, @Nullable String value) throws RepositoryException;
 
     /**
      * Returns all <code>Authorizable</code>s that have a
@@ -146,7 +153,8 @@
      * @return An iterator of <code>Authorizable</code>.
      * @throws RepositoryException If an error occurs.
      */
-    Iterator<Authorizable> findAuthorizables(String relPath, String value, int searchType) throws RepositoryException;
+    @NotNull
+    Iterator<Authorizable> findAuthorizables(@NotNull String relPath, @Nullable String value, int searchType) throws RepositoryException;
 
     /**
      * Return {@link Authorizable}s that match a specific {@link Query}.
@@ -155,7 +163,8 @@
      * @return  Iterator of authorizables witch match the <code>query</code>.
      * @throws RepositoryException  If an error occurs.
      */
-    Iterator<Authorizable> findAuthorizables(Query query) throws RepositoryException;
+    @NotNull
+    Iterator<Authorizable> findAuthorizables(@NotNull Query query) throws RepositoryException;
 
     /**
      * Creates an User for the given userID / password pair; neither of the
@@ -171,7 +180,8 @@
      * in use or another Authorizable with the same principal name exists.
      * @throws RepositoryException If another error occurs.
      */
-    User createUser(String userID, String password) throws AuthorizableExistsException, RepositoryException;
+    @NotNull
+    User createUser(@NotNull String userID, @Nullable String password) throws AuthorizableExistsException, RepositoryException;
 
     /**
      * Creates an User for the given parameters. If the implementation is not
@@ -192,8 +202,9 @@
      * @throws RepositoryException If the current Session is
      * not allowed to create users or some another error occurs.
      */
-    User createUser(String userID, String password, Principal principal,
-                    String intermediatePath) throws AuthorizableExistsException, RepositoryException;
+    @NotNull
+    User createUser(@NotNull String userID, @Nullable String password, @NotNull Principal principal,
+                    @Nullable String intermediatePath) throws AuthorizableExistsException, RepositoryException;
 
 
     /**
@@ -218,7 +229,8 @@
      * @throws AuthorizableExistsException if an Authorizable with this id already exists.
      * @throws RepositoryException If another error occurs.
      */
-    User createSystemUser(String userID, String intermediatePath) throws AuthorizableExistsException, RepositoryException;
+    @NotNull
+    User createSystemUser(@NotNull String userID, @Nullable String intermediatePath) throws AuthorizableExistsException, RepositoryException;
 
     /**
      * Creates a Group for the given groupID, which must not be <code>null</code>.
@@ -234,7 +246,8 @@
      * {@link Authorizable#getID() ID} or principal name already exists.
      * @throws RepositoryException If another error occurs.
      */
-    Group createGroup(String groupID) throws AuthorizableExistsException, RepositoryException;
+    @NotNull
+    Group createGroup(@NotNull String groupID) throws AuthorizableExistsException, RepositoryException;
 
     /**
      * Creates a new <code>Group</code> that is based on the given principal.
@@ -248,7 +261,8 @@
      * already in use with another Authorizable.
      * @throws RepositoryException If another error occurs.
      */
-    Group createGroup(Principal principal) throws AuthorizableExistsException, RepositoryException;
+    @NotNull
+    Group createGroup(@NotNull Principal principal) throws AuthorizableExistsException, RepositoryException;
 
     /**
      * Same as {@link #createGroup(String, Principal, String)} where the
@@ -263,7 +277,8 @@
      * already in use with another Authorizable.
      * @throws RepositoryException If another error occurs.
      */
-    Group createGroup(Principal principal, String intermediatePath) throws AuthorizableExistsException, RepositoryException;
+    @NotNull
+    Group createGroup(@NotNull Principal principal, @Nullable String intermediatePath) throws AuthorizableExistsException, RepositoryException;
 
     /**
      * Creates a new <code>Group</code> that is based on the given id, principal
@@ -281,7 +296,8 @@
      * in use with another Authorizable.
      * @throws RepositoryException If another error occurs.
      */
-    Group createGroup(String groupID, Principal principal, String intermediatePath) throws AuthorizableExistsException, RepositoryException;
+    @NotNull
+    Group createGroup(@NotNull String groupID, @NotNull Principal principal, @Nullable String intermediatePath) throws AuthorizableExistsException, RepositoryException;
 
     /**
      * If any write operations executed through the User API are automatically