[jira] [Created] (JCRVLT-515) AdminPermissionChecker should evaluate all principals bound to the Session

["Konrad Windszus (Jira)" <ji...@apache.org>]

Konrad Windszus created JCRVLT-515:
--------------------------------------

             Summary: AdminPermissionChecker should evaluate all principals bound to the Session
                 Key: JCRVLT-515
                 URL: https://issues.apache.org/jira/browse/JCRVLT-515
             Project: Jackrabbit FileVault
          Issue Type: Improvement
          Components: vlt
            Reporter: Konrad Windszus
             Fix For: 3.4.12


Currently the AdminPermissionChecker only evaluates the session-bound user id in https://github.com/kwin/jackrabbit-filevault/blob/49e3c2179c18e0552e49b0671843d85d045ebf48/vault-core/src/main/java/org/apache/jackrabbit/vault/packaging/impl/AdminPermissionChecker.java#L54. This does not work well with principal based login (like with Sling Service Authentication) as in general only the principal is returned (in case it is backed by a real JCR user). Instead one should leverage {{org.apache.jackrabbit.api.security.principal.PrincipalManager}} to retrieve all principals bound to the session and check that at least one is configured to have the access.



--
This message was sent by Atlassian Jira
(v8.3.4#803005)