You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@jackrabbit.apache.org by Cory Prowse <co...@prowse.com> on 2010/08/01 11:28:20 UTC
ACL Order reversed?
Hi,
I am attempting to set an ACL on a node which allows the AUTHORS group all privileges, and denies EVERYONE all privileges, and it seems the order of the entries in the ACL is reversed.
I use the following snippet of code to set the ACL on a node:
// ALLOW authors ALL
jackrabbitAccessControlList.addAccessControlEntry(AUTHORS_GROUP,
new Privilege[] { acm.privilegeFromName(Privilege.JCR_ALL) });
// DENY everyone ALL
jackrabbitAccessControlList.addEntry(EveryonePrincipal.getInstance(),
new Privilege[] { acm.privilegeFromName(Privilege.JCR_ALL) }, false);
This does not work, however if these entries are added in reverse order (DENY:everyone first, followed by ALLOW:authors) then I get the outcome I'm looking for.
I have verified the order is reversed by stepping through the method "ACLProvider.buildResult()".
Is this expected behaviour?
-- Cory
Re: ACL Order reversed?
Posted by Alexander Klimetschek <ak...@day.com>.
On Mon, Aug 2, 2010 at 14:36, Cory Prowse <co...@prowse.com> wrote:
> I thought that if I set the ACL in the order "ALLOW:authors, DENY:everyone" that when a Principal in the authors group attempted access it would be allowed since the ALLOW would apply first.
> This is not the case and in fact any author us denied.
>From what I know, this is the expected case, I think.
> However if I set the ACL in the order "DENY:everyone, ALLOW:authors" then authors are allowed access.
Not sure, but it should probably have the same effect (deny wins),
regardless of the order...
> Actually, it's a bit more weird than that even. When set "ALLOW:authors, DENY:everyone" by a Principal who is an author, then while their session is active they get access to the node but not to the properties of the node (this is after the Session.save() to apply the ACL).
> However if I restart the App Server then the authors are consistently denied access to the node, which seems to me to point to something weird going on.
The change might not have effect on existing sessions. You need to
refresh the sessions or get new ones. See also
http://www.day.com/specs/jcr/2.0/16_Access_Control_Management.html#InteractionwiththeTransientLayerandTransactions
> For now it seems to work fine if I set the ACL in reverse order. I haven't tested with more than two ACL entries applied to a node.
Regards,
Alex
--
Alexander Klimetschek
alexander.klimetschek@day.com
Re: ACL Order reversed?
Posted by Cory Prowse <co...@prowse.com>.
I thought that if I set the ACL in the order "ALLOW:authors, DENY:everyone" that when a Principal in the authors group attempted access it would be allowed since the ALLOW would apply first.
This is not the case and in fact any author us denied.
However if I set the ACL in the order "DENY:everyone, ALLOW:authors" then authors are allowed access.
Actually, it's a bit more weird than that even. When set "ALLOW:authors, DENY:everyone" by a Principal who is an author, then while their session is active they get access to the node but not to the properties of the node (this is after the Session.save() to apply the ACL).
However if I restart the App Server then the authors are consistently denied access to the node, which seems to me to point to something weird going on.
For now it seems to work fine if I set the ACL in reverse order. I haven't tested with more than two ACL entries applied to a node.
-- Cory
On 02/08/2010, at 8:08 PM, Alexander Klimetschek wrote:
> On Sun, Aug 1, 2010 at 11:28, Cory Prowse <co...@prowse.com> wrote:
>> I am attempting to set an ACL on a node which allows the AUTHORS group all privileges, and denies EVERYONE all privileges, and it seems the order of the entries in the ACL is reversed.
>>
>> I use the following snippet of code to set the ACL on a node:
>>
>> // ALLOW authors ALL
>> jackrabbitAccessControlList.addAccessControlEntry(AUTHORS_GROUP,
>> new Privilege[] { acm.privilegeFromName(Privilege.JCR_ALL) });
>> // DENY everyone ALL
>> jackrabbitAccessControlList.addEntry(EveryonePrincipal.getInstance(),
>> new Privilege[] { acm.privilegeFromName(Privilege.JCR_ALL) }, false);
>>
>> This does not work, however if these entries are added in reverse order (DENY:everyone first, followed by ALLOW:authors) then I get the outcome I'm looking for.
>
> What do you mean by it does not work? Are the entries not saved? Is
> one missing? Are the final privileges different from what you expect?
> What exactly do you expect?
>
>> I have verified the order is reversed by stepping through the method "ACLProvider.buildResult()".
>>
>> Is this expected behaviour?
>
> I think so, because DENY wins over ALLOW entries in general. And in
> the authors group is also everyone...
>
> Regards,
> Alex
>
> --
> Alexander Klimetschek
> alexander.klimetschek@day.com
Re: ACL Order reversed?
Posted by Alexander Klimetschek <ak...@day.com>.
On Mon, Aug 2, 2010 at 12:08, Alexander Klimetschek <ak...@day.com> wrote:
> And in the authors group is also everyone...
Scrap the "in": And the authors group is also part of everyone.
Alex
--
Alexander Klimetschek
alexander.klimetschek@day.com
Re: ACL Order reversed?
Posted by Alexander Klimetschek <ak...@day.com>.
On Mon, Aug 2, 2010 at 16:19, Angela Schreiber <an...@day.com> wrote:
>
>> I think so, because DENY wins over ALLOW entries in general.
>
> no, that's not true.
Then only in case the ACL of an ancestor node defining a DENY, which
would win over any ALLOW in the tree below? But not inside a single
access control list?
Regards,
Alex
--
Alexander Klimetschek
alexander.klimetschek@day.com
Re: ACL Order reversed?
Posted by Angela Schreiber <an...@day.com>.
> I think so, because DENY wins over ALLOW entries in general.
no, that's not true.
angela
Re: ACL Order reversed?
Posted by Alexander Klimetschek <ak...@day.com>.
On Sun, Aug 1, 2010 at 11:28, Cory Prowse <co...@prowse.com> wrote:
> I am attempting to set an ACL on a node which allows the AUTHORS group all privileges, and denies EVERYONE all privileges, and it seems the order of the entries in the ACL is reversed.
>
> I use the following snippet of code to set the ACL on a node:
>
> // ALLOW authors ALL
> jackrabbitAccessControlList.addAccessControlEntry(AUTHORS_GROUP,
> new Privilege[] { acm.privilegeFromName(Privilege.JCR_ALL) });
> // DENY everyone ALL
> jackrabbitAccessControlList.addEntry(EveryonePrincipal.getInstance(),
> new Privilege[] { acm.privilegeFromName(Privilege.JCR_ALL) }, false);
>
> This does not work, however if these entries are added in reverse order (DENY:everyone first, followed by ALLOW:authors) then I get the outcome I'm looking for.
What do you mean by it does not work? Are the entries not saved? Is
one missing? Are the final privileges different from what you expect?
What exactly do you expect?
> I have verified the order is reversed by stepping through the method "ACLProvider.buildResult()".
>
> Is this expected behaviour?
I think so, because DENY wins over ALLOW entries in general. And in
the authors group is also everyone...
Regards,
Alex
--
Alexander Klimetschek
alexander.klimetschek@day.com