[jackrabbit-oak] branch trunk updated: OAK-9475 : Document DynamicMembershipProvider

[an...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

angela pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/jackrabbit-oak.git


The following commit(s) were added to refs/heads/trunk by this push:
     new 1936495  OAK-9475 : Document DynamicMembershipProvider
1936495 is described below

commit 1936495c723317b9d4327c105011bb856b6bdf95
Author: angela <an...@adobe.com>
AuthorDate: Thu Jun 24 19:42:10 2021 +0200

    OAK-9475 : Document DynamicMembershipProvider
---
 .../markdown/security/authentication/external/dynamic.md  | 15 ++++++++++++---
 oak-doc/src/site/markdown/security/user.md                |  3 +++
 2 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/oak-doc/src/site/markdown/security/authentication/external/dynamic.md b/oak-doc/src/site/markdown/security/authentication/external/dynamic.md
index b95a749..1e58020 100644
--- a/oak-doc/src/site/markdown/security/authentication/external/dynamic.md
+++ b/oak-doc/src/site/markdown/security/authentication/external/dynamic.md
@@ -75,6 +75,8 @@ See also [OAK-5210].
   to new instances of the `PrincipalProvider`.
 - Note, that in the initial version (Oak 1.6) only the `user.autoMembership` 
   configuration is respected (see also [OAK-5194] and [OAK-5195])
+- With [OAK-9462] an implementation of `DynamicMembershipProvider` will be registered 
+  and reflect autoMembership for synchronized external users in the User Management API (see below).
   
 #### Effect of Dynamic Membership on other Security Modules
   
@@ -106,8 +108,8 @@ user management feature but limit the synchronized information to the principal
 names and the membership relation between a given `java.security.acl.Group` principal 
 and external user accounts.
 
-The user management API will consequently no longer be knowledgeable of external 
-group identities (exception: groups that have been synchronized before enabling 
+The user management API will consequently no longer be knowledgeable of **external 
+group identities** (exception: groups that have been synchronized before enabling 
 the feature will remain untouched and will be synchronized according to the 
 sync configuration).
 
@@ -117,6 +119,12 @@ of external identities. Those application won't be able to benefit from the dyna
 membership feature until dynamic groups can be created with the 
 Jackrabbit [User Management API](../../user.html) (see [OAK-2687]).
 
+Note however, that with [OAK-9462] groups listed in the **autoMembership** configuration 
+parameters will have dynamic group membership of external user identities reflected 
+in the corresponding API calls, most notably `Group.isMember`, `Group.isDeclaredMember`, 
+`Group.getMembers`, `Group.getDeclaredMembers` as well as `Authorizable.memberOf`
+and `Authorizable.declaredMemberOf()`.
+
 ##### Authentication
 
 The authentication setup provided by Oak is not affected by the dynamic membership 
@@ -143,4 +151,5 @@ membership configuration.
 [OAK-4087]: https://issues.apache.org/jira/browse/OAK-4087
 [OAK-5194]: https://issues.apache.org/jira/browse/OAK-5194
 [OAK-5195]: https://issues.apache.org/jira/browse/OAK-5195
-[OAK-5210]: https://issues.apache.org/jira/browse/OAK-5210
\ No newline at end of file
+[OAK-5210]: https://issues.apache.org/jira/browse/OAK-5210
+[OAK-9462]: https://issues.apache.org/jira/browse/OAK-9462
\ No newline at end of file
diff --git a/oak-doc/src/site/markdown/security/user.md b/oak-doc/src/site/markdown/security/user.md
index a5281a2..fd75c6b 100644
--- a/oak-doc/src/site/markdown/security/user.md
+++ b/oak-doc/src/site/markdown/security/user.md
@@ -53,6 +53,9 @@ interfaces and classes:
 - `GroupAction` (via `AuthorizableActionProvider`): see [Group Actions](user/groupaction.html) for details.
 - `UserAuthenticationFactory`: see sections [pluggability](user/default.html#pluggability) 
 and [user authentication](authentication/default.html#user_authentication) for additional details.
+- `DynamicMembershipService` and `DynamicMembershipProvider` to reflect dynamic group membership. The new interfaces allow 
+   to extend the default behavior which is limited to _everyone_ as described in [Built-in Users and Special Groups](user/default.html).
+   See [User and Group Synchronization : Dynamic Membership](authentication/external/dynamic.html) for an example.
 
 <a name="utilities"></a>
 ### Utilities