You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@sling.apache.org by "Ian Boston (JIRA)" <ji...@apache.org> on 2009/09/16 10:17:58 UTC
[jira] Created: (SLING-1110) DefaultPluggableAccessManager is all
or nothing with AccessManagerPlugin implementations
DefaultPluggableAccessManager is all or nothing with AccessManagerPlugin implementations
-----------------------------------------------------------------------------------------
Key: SLING-1110
URL: https://issues.apache.org/jira/browse/SLING-1110
Project: Sling
Issue Type: Bug
Components: JCR
Affects Versions: JCR Jackrabbit Server 2.0.4
Reporter: Ian Boston
Assignee: Ian Boston
If there is a AccessManagerPlugin then it must handle all access control assertions, making the implementation of the plugin hard. It would be better if the AMP can return null to indicate that it cant handle the assertion.
Discussed at http://markmail.org/thread/4ym7eh4xsocbev37
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (SLING-1110) DefaultPluggableAccessManager is all
or nothing with AccessManagerPlugin implementations
Posted by "Ian Boston (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SLING-1110?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12756260#action_12756260 ]
Ian Boston commented on SLING-1110:
-----------------------------------
------------------- from the thread--------------------------
However, after sleeping on the issue, I am not certain that the changes achieve the desired results.
the AMP can express an opinion at the item level, but in order for it to be really useful I think it needs to express an opinion at the ACL level. I will try and explain in as few words as possible.
In the DefaultAccessManager (DAM) the effective ACL, bound to the set of principals associated with the user is constructed by a hierarchical search, if the AMP desires to make decisions compatible with principal bound ACL's (IMHO, it does) then it will need to be able to construct the ACL.
Consequently the patch in SLING-1110 is moot, although it allows the AMP to delegate to the DAM, it wont remove the need to duplicate the ACL construction code in the DAM, and so the patch doesn't actually address the fundamental use case, which IMHO is to plug in access control customizations on a user-item basis compatible with the DAM and ACL based access control in Jackrabbit 1.5 and critically in Jackrabbit 2.
At the moment this issue is, "do nothing and think again"
---------------------------------------------------------------------
Ian
> DefaultPluggableAccessManager is all or nothing with AccessManagerPlugin implementations
> -----------------------------------------------------------------------------------------
>
> Key: SLING-1110
> URL: https://issues.apache.org/jira/browse/SLING-1110
> Project: Sling
> Issue Type: Bug
> Components: JCR
> Affects Versions: JCR Jackrabbit Server 2.0.4
> Reporter: Ian Boston
> Assignee: Ian Boston
> Attachments: SLING-1110.diff
>
>
> If there is a AccessManagerPlugin then it must handle all access control assertions, making the implementation of the plugin hard. It would be better if the AMP can return null to indicate that it cant handle the assertion.
> Discussed at http://markmail.org/thread/4ym7eh4xsocbev37
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (SLING-1110) DefaultPluggableAccessManager is all
or nothing with AccessManagerPlugin implementations
Posted by "Ian Boston (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SLING-1110?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Ian Boston updated SLING-1110:
------------------------------
Attachment: SLING-1110.diff
First pass at a patch/refactor to address this issue.
> DefaultPluggableAccessManager is all or nothing with AccessManagerPlugin implementations
> -----------------------------------------------------------------------------------------
>
> Key: SLING-1110
> URL: https://issues.apache.org/jira/browse/SLING-1110
> Project: Sling
> Issue Type: Bug
> Components: JCR
> Affects Versions: JCR Jackrabbit Server 2.0.4
> Reporter: Ian Boston
> Assignee: Ian Boston
> Attachments: SLING-1110.diff
>
>
> If there is a AccessManagerPlugin then it must handle all access control assertions, making the implementation of the plugin hard. It would be better if the AMP can return null to indicate that it cant handle the assertion.
> Discussed at http://markmail.org/thread/4ym7eh4xsocbev37
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.