You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@sling.apache.org by bu...@apache.org on 2016/07/25 14:15:06 UTC
svn commit: r993717 - in /websites/staging/sling/trunk/content: ./
documentation/bundles/sling-oak-restrictions.html
Author: buildbot
Date: Mon Jul 25 14:15:06 2016
New Revision: 993717
Log:
Staging update by buildbot for sling
Added:
websites/staging/sling/trunk/content/documentation/bundles/sling-oak-restrictions.html
Modified:
websites/staging/sling/trunk/content/ (props changed)
Propchange: websites/staging/sling/trunk/content/
------------------------------------------------------------------------------
--- cms:source-revision (original)
+++ cms:source-revision Mon Jul 25 14:15:06 2016
@@ -1 +1 @@
-1754009
+1754011
Added: websites/staging/sling/trunk/content/documentation/bundles/sling-oak-restrictions.html
==============================================================================
--- websites/staging/sling/trunk/content/documentation/bundles/sling-oak-restrictions.html (added)
+++ websites/staging/sling/trunk/content/documentation/bundles/sling-oak-restrictions.html Mon Jul 25 14:15:06 2016
@@ -0,0 +1,214 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
+<html>
+<!--
+
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements. See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE- 2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+ <head>
+ <meta http-equiv="Content-Type" content="text/html;charset=UTF-8">
+ <title>Apache Sling - Sling Oak Restrictions</title>
+ <link rel="icon" href="/res/favicon.ico">
+ <link rel="stylesheet" href="/res/site.css" type="text/css" media="all">
+ <link rel="stylesheet" href="/res/codehilite.css" type="text/css" media="all">
+ </head>
+ <body>
+ <div class="title">
+ <div class="logo">
+ <a href="//sling.apache.org/">
+ <img border="0" alt="Apache Sling" src="/res/logo.png">
+ </a>
+ </div>
+ <div class="header">
+ <a href="//www.apache.org/">
+ <img border="0" alt="Apache" src="/res/apache.png">
+ </a>
+ </div>
+ </div>
+
+ <div class="menu">
+ <style type="text/css">
+/* The following code is added by mdx_elementid.py
+ It was originally lifted from http://subversion.apache.org/style/site.css */
+/*
+ * Hide class="elementid-permalink", except when an enclosing heading
+ * has the :hover property.
+ */
+.headerlink, .elementid-permalink {
+ visibility: hidden;
+}
+h2:hover > .headerlink, h3:hover > .headerlink, h1:hover > .headerlink, h6:hover > .headerlink, h4:hover > .headerlink, h5:hover > .headerlink, dt:hover > .elementid-permalink { visibility: visible }</style>
+<p><strong><a href="/documentation.html">Documentation</a></strong> <br />
+<a href="/documentation/getting-started.html">Getting Started</a> <br />
+<a href="/documentation/the-sling-engine.html">The Sling Engine</a> <br />
+<a href="/documentation/development.html">Development</a> <br />
+<a href="/documentation/bundles.html">Bundles</a> <br />
+<a href="/documentation/tutorials-how-tos.html">Tutorials & How-Tos</a> <br />
+<a href="/documentation/configuration.html">Configuration</a> </p>
+<p><a href="http://s.apache.org/sling.wiki">Wiki</a> <br />
+<a href="http://s.apache.org/sling.faq">FAQ</a> </p>
+<p><strong>API Docs</strong> <br />
+<a href="/apidocs/sling8/index.html">Sling 8</a> <br />
+<a href="/apidocs/sling7/index.html">Sling 7</a> <br />
+<a href="/apidocs/sling6/index.html">Sling 6</a> <br />
+<a href="/apidocs/sling5/index.html">Sling 5</a> <br />
+<a href="/javadoc-io.html">Archive at javadoc.io</a> </p>
+<p><strong>Project info</strong> <br />
+<a href="/downloads.cgi">Downloads</a> <br />
+<a href="http://www.apache.org/licenses/">License</a> <br />
+<a href="/contributing.html">Contributing</a> <br />
+<a href="/news.html">News</a> <br />
+<a href="/links.html">Links</a> <br />
+<a href="/project-information.html">Project Information</a> <br />
+<a href="https://issues.apache.org/jira/browse/SLING">Issue Tracker</a> <br />
+<a href="http://ci.apache.org/builders/sling-trunk">Build Server</a> <br />
+<a href="/project-information/security.html">Security</a> </p>
+<p><strong>Source</strong> <br />
+<a href="http://svn.apache.org/viewvc/sling/trunk">Subversion</a> <br />
+<a href="git://git.apache.org/sling.git">Git</a> <br />
+<a href="https://github.com/apache/sling">Github Mirror</a> </p>
+<p><strong>Sponsorship</strong> <br />
+<a href="http://www.apache.org/foundation/thanks.html">Thanks</a> <br />
+<a href="http://www.apache.org/foundation/sponsorship.html">Become a Sponsor</a> <br />
+<a href="http://www.apache.org/foundation/buy_stuff.html">Buy Stuff</a> </p>
+<p><strong><a href="/sitemap.html">Site Map</a></strong></p>
+<!-- no valid ads for now, we'll reactivate this when needed
+<iframe
+ src="http://www.apache.org/ads/button.html"
+ style="border-width:0; float: left" frameborder="0"
+ scrolling="no"
+ width="135"
+ height="135">
+</iframe>
+-->
+ </div>
+
+ <div class="main">
+ <div class="breadcrump" style="font-size: 80%;">
+ <a href="/">Home</a> » <a href="/documentation.html">Documentation</a> » <a href="/documentation/bundles.html">Bundles</a>
+ </div>
+
+
+
+ <h1>Sling Oak Restrictions</h1>
+ <style type="text/css">
+/* The following code is added by mdx_elementid.py
+ It was originally lifted from http://subversion.apache.org/style/site.css */
+/*
+ * Hide class="elementid-permalink", except when an enclosing heading
+ * has the :hover property.
+ */
+.headerlink, .elementid-permalink {
+ visibility: hidden;
+}
+h2:hover > .headerlink, h3:hover > .headerlink, h1:hover > .headerlink, h6:hover > .headerlink, h4:hover > .headerlink, h5:hover > .headerlink, dt:hover > .elementid-permalink { visibility: visible }</style>
+<div class="toc">
+<ul>
+<li><a href="#introduction">Introduction</a></li>
+<li><a href="#restriction-slingresourcetypes">Restriction sling:resourceTypes</a></li>
+<li><a href="#restriction-slingresourcetypeswithchildren">Restriction sling:resourceTypesWithChildren</a></li>
+<li><a href="#advanced-path-matching">Advanced Path Matching</a></li>
+</ul>
+</div>
+<h2 id="introduction">Introduction<a class="headerlink" href="#introduction" title="Permanent link">¶</a></h2>
+<p>Oak introduced plugability of restrictions as described in <a href="https://jackrabbit.apache.org/oak/docs/security/authorization/restriction.html#Pluggability">Oak Restriction Management</a>. The bundle sling-oak-restrictions provides additional restrictions that make sense to all sling application. Currently sling restrictions for exact resource type match and resource type match including all children are supplied.</p>
+<p><strong>Important:</strong> Using the sling restrictions (as well as standard oak restrictions) is not as performant as simple path based ACE entries without any restrictions. Permission setups should always mostly work with path based ACEs and only use ACEs with restrictions for special cases. </p>
+<h2 id="restriction-slingresourcetypes">Restriction sling:resourceTypes<a class="headerlink" href="#restriction-slingresourcetypes" title="Permanent link">¶</a></h2>
+<p>This restriction allows to match against a sling resource type of a node and works much like the oak standard restriction <code>rep:ntNames</code>. Only resources that have one of the supplied resource types are matched, child and parent resources with other resource types are not matched. </p>
+<p>The following example allows <code>myAuthorizable</code> to write to all nodes that have either resource type <code>myproj/comp1</code> or <code>myproj/comp2</code>:</p>
+<p><code>- /content/myprj/mynode
+ - rep:policy (rep:ACL)
+ - allow (rep:GrantACE)
+ + principalName (String) = "myAuthorizable"
+ + rep:privileges (Name[]) = "rep:write"
+ - rep:restrictions (rep:Restrictions)
+ + sling:resourceTypes (String[]) = [myproj/comp1,myproj/comp2]</code></p>
+<p>Assuming the following structure</p>
+<p>```
+- /content/myprj
+ + sling:resourceType (String) = "myproj/siteroot"
+ - mynode
+ + sling:resourceType (String) = "myproj/comp1"
+ - mysubnode
+ + sling:resourceType (String) = "myproj/comp3"</p>
+<p>```</p>
+<p>the rule from above will match <code>/content/myprj/mynode</code> and not <code>/content/myprj</code> nor <code>/content/myprj/mynode/mysubnode</code></p>
+<p>Naturally (as with any oak restrictions), the rule is limited to its base path. In case the node <code>/content/myprj/othernode</code> is of resource type <code>myproj/comp1</code>, it will still not match.</p>
+<h2 id="restriction-slingresourcetypeswithchildren">Restriction sling:resourceTypesWithChildren<a class="headerlink" href="#restriction-slingresourcetypeswithchildren" title="Permanent link">¶</a></h2>
+<p>This restriction matches against resource types in the same way as <code>sling:resourceTypes</code>, except that it will also match all children of a matched node.</p>
+<p>The folowing example allows <code>myAuthorizable</code> to write to all nodes that have either resource type <code>myproj/comp1</code> or <code>myproj/comp2</code> <strong>or are a child of a node, that has one of these resource types</strong>:</p>
+<p><code>- /content/myprj/mynode
+ - rep:policy (rep:ACL)
+ - allow (rep:GrantACE)
+ + principalName (String) = "myAuthorizable"
+ + rep:privileges (Name[]) = "rep:write"
+ - rep:restrictions (rep:Restrictions)
+ + sling:resourceTypesWithChildren (String[]) = [myproj/comp1,myproj/comp2]</code></p>
+<p>Assuming the structure example as mentioned in <a href="#restriction-sling_resourceTypes">sling:resourceTypes</a>, the rule from above will match <code>/content/myprj/mynode</code> and <code>/content/myprj/mynode/mysubnode</code> (and any other subnodes of <code>/content/myprj/mynode</code> with arbitrary resource types), but not <code>/content/myprj</code>.</p>
+<h2 id="advanced-path-matching">Advanced Path Matching<a class="headerlink" href="#advanced-path-matching" title="Permanent link">¶</a></h2>
+<p>Both <a href="#restriction-sling_resourceTypes">sling:resourceTypes</a> and <a href="#restriction-sling_resourceTypesWithChildren">sling:resourceTypesWithChildren</a> support advanced path matching by using <code>resourcetype@path</code>. That way instead of checking the resource type of the current node, the resource type of node at the relative path is checked. For instnace this is useful for the case where page content is stored in a <code>jcr:content</code> subnode of a hierarchy, the permission however is required to become effective on the parent node of <code>jcr:content</code>. </p>
+<p>The folowing example allows <code>myAuthorizable</code> to write to all nodes that have a subnode <code>jcr:content</code> with resource type <code>myproj/comp1</code> or <code>myproj/comp2</code> including their children:</p>
+<p><code>- /content/myprj/mynode
+ - rep:policy (rep:ACL)
+ - allow (rep:GrantACE)
+ + principalName (String) = "myAuthorizable"
+ + rep:privileges (Name[]) = "rep:write"
+ - rep:restrictions (rep:Restrictions)
+ + sling:resourceTypesWithChildren (String[]) = [myproj/comp1@jcr:content,myproj/comp2@jcr:content]</code></p>
+<p>Assuming the following structure</p>
+<p>```
+- /content/myprj
+ - jcr:content
+ + sling:resourceType (String) = "myproj/siteroot"
+ - mynode1
+ - jcr:content
+ + sling:resourceType (String) = "myproj/comp1"
+ - mysubnode1
+ - jcr:content
+ + sling:resourceType (String) = "myproj/comp3"
+ - contentsubnode1
+ + sling:resourceType (String) = "myproj/comp4"
+ - contentsubnode2
+ + sling:resourceType (String) = "myproj/comp5"
+ - mysubnode2
+ - jcr:content
+ + sling:resourceType (String) = "myproj/comp3"
+ - mynode2
+ - jcr:content
+ + sling:resourceType (String) = "myproj/comp7"</p>
+<p>```
+the rule from above will match </p>
+<ul>
+<li><code>/content/myprj/mynode1</code> (because of the <code>@jcr:content</code> part of <code>myproj/comp1@jcr:content</code>)</li>
+<li><code>/content/myprj/mynode1/jcr:content</code> (it will check for <code>/content/myprj/mynode1/jcr:content/jcr:content</code> that does not exist, but since the parent <code>/content/myprj/mynode1</code> is already a match this matches because of <code>sling:resourceTypesWithChildren</code>)</li>
+<li><code>/content/myprj/mynode1/contentsubnode1</code> (because of <code>sling:resourceTypesWithChildren</code>)</li>
+<li><code>/content/myprj/mynode1/contentsubnode1</code> (because of <code>sling:resourceTypesWithChildren</code>)</li>
+</ul>
+<p>and not match</p>
+<ul>
+<li><code>/content/myprj</code> </li>
+<li><code>/content/myprj/mynode2</code> </li>
+</ul>
+ <div class="timestamp" style="margin-top: 30px; font-size: 80%; text-align: right;">
+ Rev. 1754011 by rombert on Mon, 25 Jul 2016 14:14:58 +0000
+ </div>
+ <div class="trademarkFooter">
+ Apache Sling, Sling, Apache, the Apache feather logo, and the Apache Sling project
+ logo are trademarks of The Apache Software Foundation. All other marks mentioned
+ may be trademarks or registered trademarks of their respective owners.
+ </div>
+ </div>
+ </body>
+</html>