LoginAdminWhitelist: default bundles vs additional bundles

[Julian Sedding <js...@gmail.com>]

Hi all

The LoginAdminWhitelist has two lists of whitelisted bundles,
"default" and "additional". The rational as I understand it was to
distinguish between a whitelist that is shipped with a product
(default) and a whitelist that a user of the product can administer
(additional).

This kind of works with the default value of the "default" whitelist,
i.e. the bundles hard-coded as defaults in Sling. However, if a
product provides its own "default" configuration via config admin, any
user of the product setting their own "additional" config will wipe
out the product's "default" config (or copy it over and cause issues
with later updates).

Therefore I am wondering if we shouldn't create a factory
configuration instead and scrap the "additional" config property.
WDYT?

Regards
Julian

Re: LoginAdminWhitelist: default bundles vs additional bundles

[Carsten Ziegeler <cz...@apache.org>]

Julian Sedding wrote
> Hi all
> 
> The LoginAdminWhitelist has two lists of whitelisted bundles,
> "default" and "additional". The rational as I understand it was to
> distinguish between a whitelist that is shipped with a product
> (default) and a whitelist that a user of the product can administer
> (additional).
> 
> This kind of works with the default value of the "default" whitelist,
> i.e. the bundles hard-coded as defaults in Sling. However, if a
> product provides its own "default" configuration via config admin, any
> user of the product setting their own "additional" config will wipe
> out the product's "default" config (or copy it over and cause issues
> with later updates).
> 
> Therefore I am wondering if we shouldn't create a factory
> configuration instead and scrap the "additional" config property.
> WDYT?
> 

I think we should not make it too easy to provide additional configurations.
If it's just as easy as creating a configuration with your symbolic
name, everyone will just do. Therefore I think the current approach is
totally fine. If someone wants to add another bundle in your scenario it
has to be added as another value to the already existing configuration.

Carsten

 

-- 
Carsten Ziegeler
Adobe Research Switzerland
cziegeler@apache.org