You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@jackrabbit.apache.org by Vidar Ramdal <vi...@idium.no> on 2008/05/22 11:52:40 UTC
Limiting access to node children in Jackrabbit 1.5
Continuing a thread (http://markmail.org/message/tz3zfoddbmwgllgy )
from users@j.a.o:
Vidar Ramdal wrote:
>>>> I want to set access control policies so that a parent
>>>> node (e.g. /node) is readable for Everyone, but a child
>>>> node (/node/childnode) is only readable for specific principals.
>>>> So I grant READ to Everyone on the parent node. This
>>>> renders /node and the entire subtree readable for everyone.
>>>> Next, I want to specify NO_PRIVILEGES for Everyone on
>>>> the protected child node, and grant READ access to a specific
>>>> user on the child node
>>>> [...]
Angela Schreiber wrote:
>>> [...]
>>> the jackrabbit implementation currently allows to
>>> edit a policy obtained through AccessControlManager.getPolicy
>>> and there you may add a DENY ace.
>>> [...]
Vidar Ramdal wrote:
>> How do I create an instance of an ACE? Both PolicyEntryImpl
>> and ACEImpl are package local, as is ACLEditor ...
Jukka Zitting wrote:
> Could we take this to dev@ please?
So devs, how do I create an instance of an ACE?
--
Vidar S. Ramdal <vi...@idium.no> - http://www.idium.no
Akersgata 16, N-0158 Oslo, Norway
Re: Limiting access to node children in Jackrabbit 1.5
Posted by Angela Schreiber <an...@day.com>.
Vidar Ramdal wrote:
> Vidar Ramdal wrote:
>>> How do I create an instance of an ACE? Both PolicyEntryImpl
>>> and ACEImpl are package local, as is ACLEditor ...
i think this is a mistake (leftover).
you can change it in your checkout.
the ACL stuff will be reworked soon due to modified
specification. so i won't touch that right now.
regards
angela
Re: Limiting access to node children in Jackrabbit 1.5
Posted by Vidar Ramdal <vi...@idium.no>.
On Thu, May 22, 2008 at 2:27 PM, Jukka Zitting <ju...@gmail.com> wrote:
>
> Hi,
>
> On Thu, May 22, 2008 at 2:37 PM, Vidar Ramdal <vi...@idium.no> wrote:
> > Yes, I've read the spec draft, but the sections on access control
> > policies (6.11.2) is very generic, leaving a lot to be desired by the
> > different implementations (as I suspect you know :). Allthough I
> > prefer writing as much as possible by the spec, the feature I need
> > (limiting child node access) is a must-have. I guess the chances of
> > that feature being included in the JSR are pretty slim?
> Doesn't AccessControlManager.addAccessControlEntry() cover your needs?
I don't think so, no. There doesn't seem to be a way to restrict
privileges, ref. the error I got:
http://markmail.org/message/tz3zfoddbmwgllgy (if I'm mistaken, I'd be
really happy to know).
In contrast, with PolicyTemplate.setEntry(Principal, int, boolean) I
can specify a boolean false (for DENY). This specific "negative" ACE
would deny access to a child node (AFAIK).
> It sounds like you are looking for a setup where you grant access to
> the root node, but don't want those permissions to apply to the entire
> tree so you can selectively enable access to specific child nodes or
> subtrees.
Exactly.
--
Vidar S. Ramdal <vi...@idium.no> - http://www.idium.no
Akersgata 16, N-0158 Oslo, Norway
Re: Limiting access to node children in Jackrabbit 1.5
Posted by Jukka Zitting <ju...@gmail.com>.
Hi,
On Thu, May 22, 2008 at 2:37 PM, Vidar Ramdal <vi...@idium.no> wrote:
> Yes, I've read the spec draft, but the sections on access control
> policies (6.11.2) is very generic, leaving a lot to be desired by the
> different implementations (as I suspect you know :). Allthough I
> prefer writing as much as possible by the spec, the feature I need
> (limiting child node access) is a must-have. I guess the chances of
> that feature being included in the JSR are pretty slim?
Doesn't AccessControlManager.addAccessControlEntry() cover your needs?
It sounds like you are looking for a setup where you grant access to
the root node, but don't want those permissions to apply to the entire
tree so you can selectively enable access to specific child nodes or
subtrees. I'm not too familiar with Angela's latest work, but I think
such a setup should be possible.
BR,
Jukka Zitting
Re: Limiting access to node children in Jackrabbit 1.5
Posted by Angela Schreiber <an...@day.com>.
Vidar Ramdal wrote:
> OK, that's fine. I suppose the o.a.j.api.jsr283 interfaces will mirror
> jcr-2.0.jar as much as possible, right?
right. and we are pointing out the non-final status,
since we know that there will almost certainly be
some rearrangement within the next couple of weeks.
i don't want to scare you off... just keep the
expectations low :)
angela
Re: Limiting access to node children in Jackrabbit 1.5
Posted by Vidar Ramdal <vi...@idium.no>.
On Thu, May 22, 2008 at 1:07 PM, Jukka Zitting <ju...@gmail.com> wrote:
> Hi,
>
> On Thu, May 22, 2008 at 12:52 PM, Vidar Ramdal <vi...@idium.no> wrote:
>> So devs, how do I create an instance of an ACE?
>
> You may want to check the JSR 283 public draft for general guidance
> about how the new access control system is designed to work. See also
> the o.a.j.api.jsr283.security package in the latest jackrabbit-api
> component for the client-level interfaces that we're currently working
> with.
Yes, I've read the spec draft, but the sections on access control
policies (6.11.2) is very generic, leaving a lot to be desired by the
different implementations (as I suspect you know :). Allthough I
prefer writing as much as possible by the spec, the feature I need
(limiting child node access) is a must-have. I guess the chances of
that feature being included in the JSR are pretty slim?
> Also, note that all the interfaces in o.a.j.api.jsr283 may be changed
> at any time and will be dropped (in favor of jcr-2.0.jar) in
> Jackrabbit 2.0.
OK, that's fine. I suppose the o.a.j.api.jsr283 interfaces will mirror
jcr-2.0.jar as much as possible, right?
--
Vidar S. Ramdal <vi...@idium.no> - http://www.idium.no
Akersgata 16, N-0158 Oslo, Norway
Re: Limiting access to node children in Jackrabbit 1.5
Posted by Jukka Zitting <ju...@gmail.com>.
Hi,
On Thu, May 22, 2008 at 12:52 PM, Vidar Ramdal <vi...@idium.no> wrote:
> So devs, how do I create an instance of an ACE?
You may want to check the JSR 283 public draft for general guidance
about how the new access control system is designed to work. See also
the o.a.j.api.jsr283.security package in the latest jackrabbit-api
component for the client-level interfaces that we're currently working
with.
Also, note that all the interfaces in o.a.j.api.jsr283 may be changed
at any time and will be dropped (in favor of jcr-2.0.jar) in
Jackrabbit 2.0.
BR,
Jukka Zitting