[jira] [Created] (OAK-10224) org.apache.jackrabbit.api.security.user.QueryBuilder.impersonates is not aligned with Impersonation.allows

["Angela Schreiber (Jira)" <ji...@apache.org>]

Angela Schreiber created OAK-10224:
--------------------------------------

             Summary: org.apache.jackrabbit.api.security.user.QueryBuilder.impersonates is not aligned with Impersonation.allows
                 Key: OAK-10224
                 URL: https://issues.apache.org/jira/browse/OAK-10224
             Project: Jackrabbit Oak
          Issue Type: Improvement
          Components: jackrabbit-api
            Reporter: Angela Schreiber


while discussing the improvements suggested by [~antoniu98] in OAK-10173 we found that the API definition of {{org.apache.jackrabbit.api.security.user.QueryBuilder.impersonates(String name)}} is not really aligned with {{Impersonation.allows(Subject)}}.

while for the current implementation this doesn't matter as only the admin user is able to impersonate everyone irrespective of the information stored in rep:impersonators properties, we can only make a best-effort guess on whether the specified principal name might result upon login in a subject that contains any of the configure impersonators principals.

ultimately, i would be desirable if there was a way to pass a subject to {{org.apache.jackrabbit.api.security.user.QueryBuilder.impersonates}} (or something equivalent) in order to make it properly aligned with {{Impersonation.allows(Subject)}}.

note that expanding the API would also require adjusting https://github.com/apache/jackrabbit/blob/trunk/jackrabbit-jcr-commons/src/main/ja[…]ackrabbit/commons/jackrabbit/user/AuthorizableQueryManager.java.

cc: [~antoniu98] FYI



--
This message was sent by Atlassian Jira
(v8.20.10#820010)