You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@jackrabbit.apache.org by th...@apache.org on 2018/08/30 11:48:46 UTC
svn commit: r1839663 [19/22] - in /jackrabbit/site/live/oak/docs: ./
architecture/ coldstandby/ features/ nodestore/ nodestore/document/
nodestore/segment/ oak-mongo-js/ oak_api/ plugins/ query/ security/
security/accesscontrol/ security/authentication...
Modified: jackrabbit/site/live/oak/docs/security/principal/differences.html
URL: http://svn.apache.org/viewvc/jackrabbit/site/live/oak/docs/security/principal/differences.html?rev=1839663&r1=1839662&r2=1839663&view=diff
==============================================================================
--- jackrabbit/site/live/oak/docs/security/principal/differences.html (original)
+++ jackrabbit/site/live/oak/docs/security/principal/differences.html Thu Aug 30 11:48:45 2018
@@ -1,13 +1,13 @@
<!DOCTYPE html>
<!--
- | Generated by Apache Maven Doxia Site Renderer 1.8.1 at 2018-08-29
+ | Generated by Apache Maven Doxia Site Renderer 1.7.4 at 2018-02-21
| Rendered using Apache Maven Fluido Skin 1.6
-->
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
- <meta name="Date-Revision-yyyymmdd" content="20180829" />
+ <meta name="Date-Revision-yyyymmdd" content="20180221" />
<meta http-equiv="Content-Language" content="en" />
<title>Jackrabbit Oak – Principal Management : Differences wrt Jackrabbit 2.x</title>
<link rel="stylesheet" href="../../css/apache-maven-fluido-1.6.min.css" />
@@ -52,7 +52,6 @@
<a href="#" class="dropdown-toggle" data-toggle="dropdown">Main APIs <b class="caret"></b></a>
<ul class="dropdown-menu">
<li><a href="http://www.day.com/specs/jcr/2.0/index.html" title="JCR API">JCR API</a></li>
- <li><a href="https://jackrabbit.apache.org/jcr/jcr-api.html" title="Jackrabbit API">Jackrabbit API</a></li>
<li><a href="../../oak_api/overview.html" title="Oak API">Oak API</a></li>
</ul>
</li>
@@ -67,12 +66,7 @@
<li><a href="../../nodestore/compositens.html" title="Composite NodeStore">Composite NodeStore</a></li>
</ul>
</li>
- <li class="dropdown-submenu">
-<a href="../../plugins/blobstore.html" title="Blob Storage">Blob Storage</a>
- <ul class="dropdown-menu">
- <li><a href="../../features/direct-binary-access.html" title="Direct Binary Access">Direct Binary Access</a></li>
- </ul>
- </li>
+ <li><a href="../../plugins/blobstore.html" title="Blob Storage">Blob Storage</a></li>
<li class="dropdown-submenu">
<a href="../../query/query.html" title="Query">Query</a>
<ul class="dropdown-menu">
@@ -142,7 +136,7 @@
<div id="breadcrumbs">
<ul class="breadcrumb">
- <li id="publishDate">Last Published: 2018-08-29<span class="divider">|</span>
+ <li id="publishDate">Last Published: 2018-02-21<span class="divider">|</span>
</li>
<li id="projectVersion">Version: 1.10-SNAPSHOT</li>
</ul>
@@ -161,14 +155,12 @@
<li><a href="../../architecture/nodestate.html" title="The Node State Model"><span class="none"></span>The Node State Model</a> </li>
<li class="nav-header">Main APIs</li>
<li><a href="http://www.day.com/specs/jcr/2.0/index.html" class="externalLink" title="JCR API"><span class="none"></span>JCR API</a> </li>
- <li><a href="https://jackrabbit.apache.org/jcr/jcr-api.html" class="externalLink" title="Jackrabbit API"><span class="none"></span>Jackrabbit API</a> </li>
<li><a href="../../oak_api/overview.html" title="Oak API"><span class="none"></span>Oak API</a> </li>
<li class="nav-header">Features and Plugins</li>
<li><a href="../../nodestore/overview.html" title="Node Storage"><span class="icon-chevron-down"></span>Node Storage</a>
<ul class="nav nav-list">
<li><a href="../../nodestore/documentmk.html" title="Document NodeStore"><span class="icon-chevron-down"></span>Document NodeStore</a>
<ul class="nav nav-list">
- <li><a href="../../nodestore/document/mongo-document-store.html" title="MongoDB DocumentStore"><span class="none"></span>MongoDB DocumentStore</a> </li>
<li><a href="../../nodestore/document/node-bundling.html" title="Node Bundling"><span class="none"></span>Node Bundling</a> </li>
<li><a href="../../nodestore/document/secondary-store.html" title="Secondary Store"><span class="none"></span>Secondary Store</a> </li>
<li><a href="../../nodestore/persistent-cache.html" title="Persistent Cache"><span class="none"></span>Persistent Cache</a> </li>
@@ -179,11 +171,7 @@
<li><a href="../../nodestore/compositens.html" title="Composite NodeStore"><span class="none"></span>Composite NodeStore</a> </li>
</ul>
</li>
- <li><a href="../../plugins/blobstore.html" title="Blob Storage"><span class="icon-chevron-down"></span>Blob Storage</a>
- <ul class="nav nav-list">
- <li><a href="../../features/direct-binary-access.html" title="Direct Binary Access"><span class="none"></span>Direct Binary Access</a> </li>
- </ul>
- </li>
+ <li><a href="../../plugins/blobstore.html" title="Blob Storage"><span class="none"></span>Blob Storage</a> </li>
<li><a href="../../query/query.html" title="Query"><span class="icon-chevron-down"></span>Query</a>
<ul class="nav nav-list">
<li><a href="../../query/query-engine.html" title="Query Engine"><span class="none"></span>Query Engine</a> </li>
@@ -251,24 +239,28 @@
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
- -->
-<div class="section">
+ --><div class="section">
<div class="section">
<h3><a name="Principal_Management_:_Differences_wrt_Jackrabbit_2.x"></a>Principal Management : Differences wrt Jackrabbit 2.x</h3>
<div class="section">
<h4><a name="Replacement_for_Jackrabbit_Internals"></a>Replacement for Jackrabbit Internals</h4>
<p>As of Oak 1.0 the following interfaces and class that were internal to Jackrabbit have been made part of public API exposed by Oak:</p>
-<ul>
+<ul>
+
<li><a class="externalLink" href="http://svn.apache.org/repos/asf/jackrabbit/trunk/jackrabbit-api/src/main/java/org/apache/jackrabbit/api/security/principal/PrincipalManager.java">org.apache.jackrabbit.oak.spi.security.principal.PrincipalProvider</a>: corresponds to o.a.j.core.security.principal.PrincipalProvider</li>
+
<li><a href="/oak/docs/apidocs/org/apache/jackrabbit/oak/spi/security/principal/AdminPrincipal.html">org.apache.jackrabbit.oak.spi.security.principal.AdminPrincipal</a>: corresponds to o.a.j.core.security.principal.AdminPrincipal</li>
+
<li><a href="/oak/docs/apidocs/org/apache/jackrabbit/oak/spi/security/principal/EveryonePrincipal.html">org.apache.jackrabbit.oak.spi.security.principal.EveryonePrincipal</a>: corresponds to o.a.j.core.security.principal.EveryonePrincipal</li>
+
<li><a href="/oak/docs/apidocs/org/apache/jackrabbit/oak/spi/security/principal/SystemPrincipal.html">org.apache.jackrabbit.oak.spi.security.principal.SystemPrincipal</a>: corresponds to o.a.j.core.security.SystemPrincipal</li>
</ul></div>
<div class="section">
<h4><a name="Combining_Principals_from_Different_Sources"></a>Combining Principals from Different Sources</h4>
<p>In contrast to Jackrabbit 2.x Oak only deals with a single <tt>PrincipalProvider</tt>. In order to combine principals from different sources a implementation that properly handles the different sources is required; the <a href="/oak/docs/apidocs/org/apache/jackrabbit/oak/spi/security/principal/CompositePrincipalProvider.html">CompositePrincipalProvider</a> is an example that combines multiple implementations.</p>
-<p>See section <a href="../principal.html#pluggability">Pluggability</a> for an example.</p><!-- references --></div></div></div>
+<p>See section <a href="../principal.html#pluggability">Pluggability</a> for an example.</p>
+<!-- references --></div></div></div>
</div>
</div>
</div>
Modified: jackrabbit/site/live/oak/docs/security/principal/principalprovider.html
URL: http://svn.apache.org/viewvc/jackrabbit/site/live/oak/docs/security/principal/principalprovider.html?rev=1839663&r1=1839662&r2=1839663&view=diff
==============================================================================
--- jackrabbit/site/live/oak/docs/security/principal/principalprovider.html (original)
+++ jackrabbit/site/live/oak/docs/security/principal/principalprovider.html Thu Aug 30 11:48:45 2018
@@ -1,13 +1,13 @@
<!DOCTYPE html>
<!--
- | Generated by Apache Maven Doxia Site Renderer 1.8.1 at 2018-08-29
+ | Generated by Apache Maven Doxia Site Renderer 1.7.4 at 2018-02-21
| Rendered using Apache Maven Fluido Skin 1.6
-->
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
- <meta name="Date-Revision-yyyymmdd" content="20180829" />
+ <meta name="Date-Revision-yyyymmdd" content="20180221" />
<meta http-equiv="Content-Language" content="en" />
<title>Jackrabbit Oak – Implementations of the PrincipalProvider Interface</title>
<link rel="stylesheet" href="../../css/apache-maven-fluido-1.6.min.css" />
@@ -52,7 +52,6 @@
<a href="#" class="dropdown-toggle" data-toggle="dropdown">Main APIs <b class="caret"></b></a>
<ul class="dropdown-menu">
<li><a href="http://www.day.com/specs/jcr/2.0/index.html" title="JCR API">JCR API</a></li>
- <li><a href="https://jackrabbit.apache.org/jcr/jcr-api.html" title="Jackrabbit API">Jackrabbit API</a></li>
<li><a href="../../oak_api/overview.html" title="Oak API">Oak API</a></li>
</ul>
</li>
@@ -67,12 +66,7 @@
<li><a href="../../nodestore/compositens.html" title="Composite NodeStore">Composite NodeStore</a></li>
</ul>
</li>
- <li class="dropdown-submenu">
-<a href="../../plugins/blobstore.html" title="Blob Storage">Blob Storage</a>
- <ul class="dropdown-menu">
- <li><a href="../../features/direct-binary-access.html" title="Direct Binary Access">Direct Binary Access</a></li>
- </ul>
- </li>
+ <li><a href="../../plugins/blobstore.html" title="Blob Storage">Blob Storage</a></li>
<li class="dropdown-submenu">
<a href="../../query/query.html" title="Query">Query</a>
<ul class="dropdown-menu">
@@ -142,7 +136,7 @@
<div id="breadcrumbs">
<ul class="breadcrumb">
- <li id="publishDate">Last Published: 2018-08-29<span class="divider">|</span>
+ <li id="publishDate">Last Published: 2018-02-21<span class="divider">|</span>
</li>
<li id="projectVersion">Version: 1.10-SNAPSHOT</li>
</ul>
@@ -161,14 +155,12 @@
<li><a href="../../architecture/nodestate.html" title="The Node State Model"><span class="none"></span>The Node State Model</a> </li>
<li class="nav-header">Main APIs</li>
<li><a href="http://www.day.com/specs/jcr/2.0/index.html" class="externalLink" title="JCR API"><span class="none"></span>JCR API</a> </li>
- <li><a href="https://jackrabbit.apache.org/jcr/jcr-api.html" class="externalLink" title="Jackrabbit API"><span class="none"></span>Jackrabbit API</a> </li>
<li><a href="../../oak_api/overview.html" title="Oak API"><span class="none"></span>Oak API</a> </li>
<li class="nav-header">Features and Plugins</li>
<li><a href="../../nodestore/overview.html" title="Node Storage"><span class="icon-chevron-down"></span>Node Storage</a>
<ul class="nav nav-list">
<li><a href="../../nodestore/documentmk.html" title="Document NodeStore"><span class="icon-chevron-down"></span>Document NodeStore</a>
<ul class="nav nav-list">
- <li><a href="../../nodestore/document/mongo-document-store.html" title="MongoDB DocumentStore"><span class="none"></span>MongoDB DocumentStore</a> </li>
<li><a href="../../nodestore/document/node-bundling.html" title="Node Bundling"><span class="none"></span>Node Bundling</a> </li>
<li><a href="../../nodestore/document/secondary-store.html" title="Secondary Store"><span class="none"></span>Secondary Store</a> </li>
<li><a href="../../nodestore/persistent-cache.html" title="Persistent Cache"><span class="none"></span>Persistent Cache</a> </li>
@@ -179,11 +171,7 @@
<li><a href="../../nodestore/compositens.html" title="Composite NodeStore"><span class="none"></span>Composite NodeStore</a> </li>
</ul>
</li>
- <li><a href="../../plugins/blobstore.html" title="Blob Storage"><span class="icon-chevron-down"></span>Blob Storage</a>
- <ul class="nav nav-list">
- <li><a href="../../features/direct-binary-access.html" title="Direct Binary Access"><span class="none"></span>Direct Binary Access</a> </li>
- </ul>
- </li>
+ <li><a href="../../plugins/blobstore.html" title="Blob Storage"><span class="none"></span>Blob Storage</a> </li>
<li><a href="../../query/query.html" title="Query"><span class="icon-chevron-down"></span>Query</a>
<ul class="nav nav-list">
<li><a href="../../query/query-engine.html" title="Query Engine"><span class="none"></span>Query Engine</a> </li>
@@ -251,8 +239,7 @@
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
--->
-<div class="section">
+--><div class="section">
<h2><a name="Implementations_of_the_PrincipalProvider_Interface"></a>Implementations of the PrincipalProvider Interface</h2>
<p>Oak contains by default the following implementations of the <tt>PrincipalProvider</tt> interface:</p>
<div class="section">
@@ -274,7 +261,8 @@
<p>Implementation of the <tt>PrincipalProvider</tt> interface that exposes <i>external</i> principals of type <tt>java.security.acl.Group</tt>. <i>External</i> refers to the fact that these principals are defined and managed by an external identity provider in contrast to the default implementation that represents principals native to the repository. This implies that the principals known and exposed by this provider implementation does not expect principals to be backed by an authorizable group. As such they can only be retrieved using Jackrabbit Principal Management API but not with User Management calls.</p>
<p>For performance reasons the <tt>ExternalGroupPrincipalProvider</tt> doesn’t lookup principals on the IDP but relies data persisted inside the repository where the names of these external principals are synchronized based on a configurable expiration time.</p>
<p>See section <a href="../authentication/external/defaultusersync.html">User and Group Synchronization : The Default Implementation</a> for additional details.</p>
-<p>Since Oak 1.5.3</p><!-- references --></div></div>
+<p>Since Oak 1.5.3</p>
+<!-- references --></div></div>
</div>
</div>
</div>
Modified: jackrabbit/site/live/oak/docs/security/privilege.html
URL: http://svn.apache.org/viewvc/jackrabbit/site/live/oak/docs/security/privilege.html?rev=1839663&r1=1839662&r2=1839663&view=diff
==============================================================================
--- jackrabbit/site/live/oak/docs/security/privilege.html (original)
+++ jackrabbit/site/live/oak/docs/security/privilege.html Thu Aug 30 11:48:45 2018
@@ -1,13 +1,13 @@
<!DOCTYPE html>
<!--
- | Generated by Apache Maven Doxia Site Renderer 1.8.1 at 2018-08-29
+ | Generated by Apache Maven Doxia Site Renderer 1.7.4 at 2018-02-21
| Rendered using Apache Maven Fluido Skin 1.6
-->
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
- <meta name="Date-Revision-yyyymmdd" content="20180829" />
+ <meta name="Date-Revision-yyyymmdd" content="20180221" />
<meta http-equiv="Content-Language" content="en" />
<title>Jackrabbit Oak – Privilege Management</title>
<link rel="stylesheet" href="../css/apache-maven-fluido-1.6.min.css" />
@@ -52,7 +52,6 @@
<a href="#" class="dropdown-toggle" data-toggle="dropdown">Main APIs <b class="caret"></b></a>
<ul class="dropdown-menu">
<li><a href="http://www.day.com/specs/jcr/2.0/index.html" title="JCR API">JCR API</a></li>
- <li><a href="https://jackrabbit.apache.org/jcr/jcr-api.html" title="Jackrabbit API">Jackrabbit API</a></li>
<li><a href="../oak_api/overview.html" title="Oak API">Oak API</a></li>
</ul>
</li>
@@ -67,12 +66,7 @@
<li><a href="../nodestore/compositens.html" title="Composite NodeStore">Composite NodeStore</a></li>
</ul>
</li>
- <li class="dropdown-submenu">
-<a href="../plugins/blobstore.html" title="Blob Storage">Blob Storage</a>
- <ul class="dropdown-menu">
- <li><a href="../features/direct-binary-access.html" title="Direct Binary Access">Direct Binary Access</a></li>
- </ul>
- </li>
+ <li><a href="../plugins/blobstore.html" title="Blob Storage">Blob Storage</a></li>
<li class="dropdown-submenu">
<a href="../query/query.html" title="Query">Query</a>
<ul class="dropdown-menu">
@@ -142,7 +136,7 @@
<div id="breadcrumbs">
<ul class="breadcrumb">
- <li id="publishDate">Last Published: 2018-08-29<span class="divider">|</span>
+ <li id="publishDate">Last Published: 2018-02-21<span class="divider">|</span>
</li>
<li id="projectVersion">Version: 1.10-SNAPSHOT</li>
</ul>
@@ -161,14 +155,12 @@
<li><a href="../architecture/nodestate.html" title="The Node State Model"><span class="none"></span>The Node State Model</a> </li>
<li class="nav-header">Main APIs</li>
<li><a href="http://www.day.com/specs/jcr/2.0/index.html" class="externalLink" title="JCR API"><span class="none"></span>JCR API</a> </li>
- <li><a href="https://jackrabbit.apache.org/jcr/jcr-api.html" class="externalLink" title="Jackrabbit API"><span class="none"></span>Jackrabbit API</a> </li>
<li><a href="../oak_api/overview.html" title="Oak API"><span class="none"></span>Oak API</a> </li>
<li class="nav-header">Features and Plugins</li>
<li><a href="../nodestore/overview.html" title="Node Storage"><span class="icon-chevron-down"></span>Node Storage</a>
<ul class="nav nav-list">
<li><a href="../nodestore/documentmk.html" title="Document NodeStore"><span class="icon-chevron-down"></span>Document NodeStore</a>
<ul class="nav nav-list">
- <li><a href="../nodestore/document/mongo-document-store.html" title="MongoDB DocumentStore"><span class="none"></span>MongoDB DocumentStore</a> </li>
<li><a href="../nodestore/document/node-bundling.html" title="Node Bundling"><span class="none"></span>Node Bundling</a> </li>
<li><a href="../nodestore/document/secondary-store.html" title="Secondary Store"><span class="none"></span>Secondary Store</a> </li>
<li><a href="../nodestore/persistent-cache.html" title="Persistent Cache"><span class="none"></span>Persistent Cache</a> </li>
@@ -179,11 +171,7 @@
<li><a href="../nodestore/compositens.html" title="Composite NodeStore"><span class="none"></span>Composite NodeStore</a> </li>
</ul>
</li>
- <li><a href="../plugins/blobstore.html" title="Blob Storage"><span class="icon-chevron-down"></span>Blob Storage</a>
- <ul class="nav nav-list">
- <li><a href="../features/direct-binary-access.html" title="Direct Binary Access"><span class="none"></span>Direct Binary Access</a> </li>
- </ul>
- </li>
+ <li><a href="../plugins/blobstore.html" title="Blob Storage"><span class="none"></span>Blob Storage</a> </li>
<li><a href="../query/query.html" title="Query"><span class="icon-chevron-down"></span>Query</a>
<ul class="nav nav-list">
<li><a href="../query/query-engine.html" title="Query Engine"><span class="none"></span>Query Engine</a> </li>
@@ -251,119 +239,129 @@
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
--->
-<div class="section">
+--><div class="section">
<h2><a name="Privilege_Management"></a>Privilege Management</h2>
-<a name="jcr_api"></a>
-### JCR API
-
+<p><a name="jcr_api"></a></p>
+<div class="section">
+<h3><a name="JCR_API"></a>JCR API</h3>
<p>As of JSR 283 the API contains the following privilege related interfaces and methods:</p>
-<ul>
+<ul>
+
<li><tt>Privilege</tt>: exposes the name and characteristics of a given privilege and provides constants for privilege names defined by JCR.</li>
+
<li><tt>AccessControlManager.getSupportedPrivileges(String)</tt> (see also <tt>PrivilegeManager.getRegisteredPrivileges()</tt>)</li>
+
<li><tt>AccessControlManager.privilegeFromName(String)</tt> equivalent to <tt>PrivilegeManager.getPrivilege(String)</tt></li>
</ul>
-<a name="jackrabbit_api"></a>
-### Jackrabbit API
-
+<p><a name="jackrabbit_api"></a></p></div>
+<div class="section">
+<h3><a name="Jackrabbit_API"></a>Jackrabbit API</h3>
<p>Privilege management is outside of the scope provided by JCR and therefore provided by the extensions defined by the Jackrabbit API. It consists of a single interface:</p>
-<ul>
+<ul>
+
<li><a class="externalLink" href="http://svn.apache.org/repos/asf/jackrabbit/trunk/jackrabbit-api/src/main/java/org/apache/jackrabbit/api/security/authorization/PrivilegeManager.java">PrivilegeManager</a>: privilege discovery and registration of new custom privileges.
+
<ul>
-
+
<li><tt>getRegisteredPrivileges()</tt></li>
+
<li><tt>getPrivilege(String)</tt></li>
+
<li>`registerPrivilege(String, boolean, String[])</li>
-</ul>
-</li>
+ </ul></li>
</ul>
<div class="section">
<div class="section">
-<div class="section">
<h5><a name="Examples"></a>Examples</h5>
<div class="section">
<h6><a name="Access_PrivilegeManager_in_JCR"></a>Access PrivilegeManager in JCR</h6>
-<div>
-<div>
-<pre class="source">PrivilegeManager privilegeManager = session.getWorkspace().getPrivilegeManager();
-</pre></div></div>
-</div>
+<div class="source">
+<div class="source"><pre class="prettyprint">PrivilegeManager privilegeManager = session.getWorkspace().getPrivilegeManager();
+</pre></div></div></div>
<div class="section">
<h6><a name="Access_PrivilegeManager_in_Oak"></a>Access PrivilegeManager in Oak</h6>
-<div>
-<div>
-<pre class="source">Root root = contentSession.getLatestRoot();
+<div class="source">
+<div class="source"><pre class="prettyprint">Root root = contentSession.getLatestRoot();
PrivilegeConfiguration config = securityProvider.getConfiguration(PrivilegeConfiguration.class);
PrivilegeManager privilegeManage = config.getPrivilegeManager(root, namePathMapper));
-</pre></div></div>
-</div>
+</pre></div></div></div>
<div class="section">
<h6><a name="Register_Custom_Privilege"></a>Register Custom Privilege</h6>
-<div>
-<div>
-<pre class="source">PrivilegeManager privilegeManager = session.getWorkspace().getPrivilegeManager();
+<div class="source">
+<div class="source"><pre class="prettyprint">PrivilegeManager privilegeManager = session.getWorkspace().getPrivilegeManager();
String privilegeName = ...
boolean isAbstract = ...
String[] declaredAggregateNames = ...
// NOTE: workspace operation that doesn't require Session#save()
privilegeManager.registerPrivilege(privilegeName, isAbstract, declaredAggregateNames);
</pre></div></div>
-<a name="api_extensions"></a>
-### API Extensions
+<p><a name="api_extensions"></a></p></div></div></div></div>
+<div class="section">
+<h3><a name="API_Extensions"></a>API Extensions</h3>
<ul>
-
+
<li><a href="/oak/docs/apidocs/org/apache/jackrabbit/oak/spi/security/privilege/PrivilegeConfiguration.html">PrivilegeConfiguration</a> : Oak level entry point to retrieve <tt>PrivilegeManager</tt> and privilege related configuration options.</li>
+
<li><a href="/oak/docs/apidocs/org/apache/jackrabbit/oak/spi/security/privilege/PrivilegeConstants.html">PrivilegeConstants</a> : Constants related to privilege management such as Oak names of the built-in privileges.</li>
+
<li><a href="/oak/docs/apidocs/org/apache/jackrabbit/oak/spi/security/privilege/PrivilegeBitsProvider.html">PrivilegeBitsProvider</a> : Internal provider to read <tt>PrivilegeBits</tt> from the repository content and map names to internal representation (and vice versa).</li>
+
<li><a href="/oak/docs/apidocs/org/apache/jackrabbit/oak/spi/security/privilege/PrivilegeBits.html">PrivilegeBits</a>: Internal representation of JCR privileges.</li>
</ul>
-<a name="utilities"></a>
-### Utilities
-
+<p><a name="utilities"></a></p></div>
+<div class="section">
+<h3><a name="Utilities"></a>Utilities</h3>
<p>The jcr-commons module present with Jackrabbit provide some privilege related utility methods:</p>
-<ul>
+<ul>
+
<li><tt>AccessControlUtils</tt>
+
<ul>
-
+
<li><tt>privilegesFromNames(Session session, String... privilegeNames)</tt></li>
+
<li><tt>privilegesFromNames(AccessControlManager accessControlManager, String... privilegeNames)</tt></li>
+ </ul></li>
</ul>
-</li>
-</ul>
-<a name="default_implementation"></a>
-### Oak Privilege Management Implementation
-
+<p><a name="default_implementation"></a></p></div>
+<div class="section">
+<h3><a name="Oak_Privilege_Management_Implementation"></a>Oak Privilege Management Implementation</h3>
<p>The behavior of the default privilege management implementation is described in section <a href="privilege/default.html">Privilege Management: The Default Implementation</a>.</p>
-<a name="configuration"></a>
-### Configuration
-
+<p><a name="configuration"></a></p></div>
+<div class="section">
+<h3><a name="Configuration"></a>Configuration</h3>
<p>The <a href="/oak/docs/apidocs/org/apache/jackrabbit/oak/spi/security/privilege/PrivilegeConfiguration.html">PrivilegeConfiguration</a> is the Oak level entry point to obtain a new <tt>PrivilegeManager</tt> as well as privilege related configuration options. The default implementation of the <tt>PrivilegeManager</tt> interface is based on Oak API and can equally be used for privilege related tasks in the Oak layer.</p>
-<a name="pluggability"></a>
-### Pluggability
-
+<p><a name="pluggability"></a></p></div>
+<div class="section">
+<h3><a name="Pluggability"></a>Pluggability</h3>
<p><i>Please note:</i> While it’s in theory possible to replace the default privilege management implementation in Oak, this is only recommended if you have in depth knowledge and understanding of Jackrabbit/Oak internals and are familiar with the security risk associated with it. Doing so, will most likely require a re-write of the default access control and permission evaluation.</p>
-<a name="further_reading"></a>
-### Further Reading
+<p><a name="further_reading"></a></p></div>
+<div class="section">
+<h3><a name="Further_Reading"></a>Further Reading</h3>
<ul>
-
+
<li><a href="privilege/differences.html">Differences wrt Jackrabbit 2.x</a></li>
+
<li><a href="privilege/default.html">Privilege Management : The Default Implementation</a></li>
+
<li>Mapping Privileges to Items and API Calls
+
<ul>
-
+
<li><a href="privilege/mappingtoitems.html">Mapping Privileges to Items</a></li>
+
<li><a href="privilege/mappingtoprivileges.html">Mapping API Calls to Privileges</a></li>
+ </ul></li>
</ul>
-</li>
-</ul><!-- references --></div></div></div></div></div>
+<!-- references --></div></div>
</div>
</div>
</div>
Modified: jackrabbit/site/live/oak/docs/security/privilege/default.html
URL: http://svn.apache.org/viewvc/jackrabbit/site/live/oak/docs/security/privilege/default.html?rev=1839663&r1=1839662&r2=1839663&view=diff
==============================================================================
--- jackrabbit/site/live/oak/docs/security/privilege/default.html (original)
+++ jackrabbit/site/live/oak/docs/security/privilege/default.html Thu Aug 30 11:48:45 2018
@@ -1,13 +1,13 @@
<!DOCTYPE html>
<!--
- | Generated by Apache Maven Doxia Site Renderer 1.8.1 at 2018-08-29
+ | Generated by Apache Maven Doxia Site Renderer 1.7.4 at 2018-02-21
| Rendered using Apache Maven Fluido Skin 1.6
-->
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
- <meta name="Date-Revision-yyyymmdd" content="20180829" />
+ <meta name="Date-Revision-yyyymmdd" content="20180221" />
<meta http-equiv="Content-Language" content="en" />
<title>Jackrabbit Oak – Privilege Management : The Default Implementation</title>
<link rel="stylesheet" href="../../css/apache-maven-fluido-1.6.min.css" />
@@ -52,7 +52,6 @@
<a href="#" class="dropdown-toggle" data-toggle="dropdown">Main APIs <b class="caret"></b></a>
<ul class="dropdown-menu">
<li><a href="http://www.day.com/specs/jcr/2.0/index.html" title="JCR API">JCR API</a></li>
- <li><a href="https://jackrabbit.apache.org/jcr/jcr-api.html" title="Jackrabbit API">Jackrabbit API</a></li>
<li><a href="../../oak_api/overview.html" title="Oak API">Oak API</a></li>
</ul>
</li>
@@ -67,12 +66,7 @@
<li><a href="../../nodestore/compositens.html" title="Composite NodeStore">Composite NodeStore</a></li>
</ul>
</li>
- <li class="dropdown-submenu">
-<a href="../../plugins/blobstore.html" title="Blob Storage">Blob Storage</a>
- <ul class="dropdown-menu">
- <li><a href="../../features/direct-binary-access.html" title="Direct Binary Access">Direct Binary Access</a></li>
- </ul>
- </li>
+ <li><a href="../../plugins/blobstore.html" title="Blob Storage">Blob Storage</a></li>
<li class="dropdown-submenu">
<a href="../../query/query.html" title="Query">Query</a>
<ul class="dropdown-menu">
@@ -142,7 +136,7 @@
<div id="breadcrumbs">
<ul class="breadcrumb">
- <li id="publishDate">Last Published: 2018-08-29<span class="divider">|</span>
+ <li id="publishDate">Last Published: 2018-02-21<span class="divider">|</span>
</li>
<li id="projectVersion">Version: 1.10-SNAPSHOT</li>
</ul>
@@ -161,14 +155,12 @@
<li><a href="../../architecture/nodestate.html" title="The Node State Model"><span class="none"></span>The Node State Model</a> </li>
<li class="nav-header">Main APIs</li>
<li><a href="http://www.day.com/specs/jcr/2.0/index.html" class="externalLink" title="JCR API"><span class="none"></span>JCR API</a> </li>
- <li><a href="https://jackrabbit.apache.org/jcr/jcr-api.html" class="externalLink" title="Jackrabbit API"><span class="none"></span>Jackrabbit API</a> </li>
<li><a href="../../oak_api/overview.html" title="Oak API"><span class="none"></span>Oak API</a> </li>
<li class="nav-header">Features and Plugins</li>
<li><a href="../../nodestore/overview.html" title="Node Storage"><span class="icon-chevron-down"></span>Node Storage</a>
<ul class="nav nav-list">
<li><a href="../../nodestore/documentmk.html" title="Document NodeStore"><span class="icon-chevron-down"></span>Document NodeStore</a>
<ul class="nav nav-list">
- <li><a href="../../nodestore/document/mongo-document-store.html" title="MongoDB DocumentStore"><span class="none"></span>MongoDB DocumentStore</a> </li>
<li><a href="../../nodestore/document/node-bundling.html" title="Node Bundling"><span class="none"></span>Node Bundling</a> </li>
<li><a href="../../nodestore/document/secondary-store.html" title="Secondary Store"><span class="none"></span>Secondary Store</a> </li>
<li><a href="../../nodestore/persistent-cache.html" title="Persistent Cache"><span class="none"></span>Persistent Cache</a> </li>
@@ -179,11 +171,7 @@
<li><a href="../../nodestore/compositens.html" title="Composite NodeStore"><span class="none"></span>Composite NodeStore</a> </li>
</ul>
</li>
- <li><a href="../../plugins/blobstore.html" title="Blob Storage"><span class="icon-chevron-down"></span>Blob Storage</a>
- <ul class="nav nav-list">
- <li><a href="../../features/direct-binary-access.html" title="Direct Binary Access"><span class="none"></span>Direct Binary Access</a> </li>
- </ul>
- </li>
+ <li><a href="../../plugins/blobstore.html" title="Blob Storage"><span class="none"></span>Blob Storage</a> </li>
<li><a href="../../query/query.html" title="Query"><span class="icon-chevron-down"></span>Query</a>
<ul class="nav nav-list">
<li><a href="../../query/query-engine.html" title="Query Engine"><span class="none"></span>Query Engine</a> </li>
@@ -251,8 +239,7 @@
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
--->
-<div class="section">
+--><div class="section">
<h2><a name="Privilege_Management_:_The_Default_Implementation"></a>Privilege Management : The Default Implementation</h2>
<div class="section">
<h3><a name="General_Notes"></a>General Notes</h3>
@@ -262,15 +249,14 @@
<p>A comprehensive list of changes compared to Jackrabbit 2.x can be found in the corresponding <a href="differences.html">documentation</a>.</p></div>
<div class="section">
<h3><a name="Built-in_Privileges"></a>Built-in Privileges</h3>
-<ul>
+<ul>
+
<li>
-
<p>All Privileges as defined by JSR 283</p>
-
-<div>
-<div>
-<pre class="source">jcr:read (NOTE: Aggregate since Oak 1.0)
+
+<div class="source">
+<div class="source"><pre class="prettyprint">jcr:read (NOTE: Aggregate since Oak 1.0)
jcr:modifyProperties (NOTE: Aggregate since Oak 1.0)
jcr:addChildNodes
jcr:removeNode
@@ -284,75 +270,76 @@ jcr:retentionManagement (NOTE: retention
jcr:lifecycleManagement (NOTE: lifecycle management not implemented in Oak 1.0)
jcr:write
jcr:all
-</pre></div></div>
-</li>
+</pre></div></div></li>
+
<li>
-
<p>All Privileges defined by JSR 333</p>
-
-<div>
-<div>
-<pre class="source">jcr:workspaceManagement (NOTE: wsp management not yet implemented)
+
+<div class="source">
+<div class="source"><pre class="prettyprint">jcr:workspaceManagement (NOTE: wsp management not yet implemented)
jcr:nodeTypeDefinitionManagement
jcr:namespaceManagement
-</pre></div></div>
-</li>
+</pre></div></div></li>
+
<li>
-
<p>All Privileges defined by Jackrabbit 2.x</p>
-
-<div>
-<div>
-<pre class="source">rep:write
+
+<div class="source">
+<div class="source"><pre class="prettyprint">rep:write
rep:privilegeManagement
-</pre></div></div>
-</li>
+</pre></div></div></li>
+
<li>
-
<p>New Privileges defined by OAK 1.0:</p>
-
-<div>
-<div>
-<pre class="source">rep:userManagement
+
+<div class="source">
+<div class="source"><pre class="prettyprint">rep:userManagement
rep:readNodes
rep:readProperties
rep:addProperties
rep:alterProperties
rep:removeProperties
rep:indexDefinitionManagement
-</pre></div></div>
-</li>
+</pre></div></div></li>
</ul>
<p>Please note the following differences with respect to Jackrabbit 2.x definitions:</p>
-<ul>
+<ul>
+
<li><tt>jcr:read</tt> is now an aggregation of <tt>rep:readNodes</tt> and <tt>rep:readProperties</tt></li>
+
<li><tt>jcr:modifyProperties</tt> is now an aggregation of <tt>rep:addProperties</tt>, <tt>rep:alterProperties</tt> and <tt>rep:removeProperties</tt></li>
</ul>
<div class="section">
<h4><a name="New_Privileges"></a>New Privileges</h4>
<p>The new Privileges introduced with Oak 1.0 have the following effect:</p>
-<ul>
+<ul>
+
<li><tt>rep:userManagement</tt>: Privilege required in order to write items that define user or group specific content.</li>
+
<li><tt>rep:readNodes</tt>: Privilege used to allow/deny read access to nodes (aggregate of <tt>jcr:read</tt>)</li>
+
<li><tt>rep:readProperties</tt>: Privilege used to allow/deny read access to properties (aggregate of <tt>jcr:read</tt>)</li>
+
<li><tt>rep:addProperties</tt>: Privilege required in order to create new properties (aggreate of <tt>jcr:modifyProperties</tt>)</li>
+
<li><tt>rep:alterProperties</tt>: Privilege required in order to change existing properties (aggreate of <tt>jcr:modifyProperties</tt>)</li>
+
<li><tt>rep:removeProperties</tt>: Privilege required in order to remove existing properties (aggreate of <tt>jcr:modifyProperties</tt>)</li>
+
<li><tt>rep:indexDefinitionManagement</tt>: Privilege required to create, modify or deleate index definitions.</li>
</ul></div>
<div class="section">
<h4><a name="Mapping_Privileges_to_Items_and_API_Calls"></a>Mapping Privileges to Items and API Calls</h4>
<p>An overview on how the built-in privileges map to API calls and individual items can be found in <a href="mappingtoitems.html">‘Mapping Privileges to Items’</a> and <a href="mappingtoprivileges.html">‘Mapping API Calls to Privileges’</a></p>
-<a name="representation"></a>
-### Representation in the Repository
-
+<p><a name="representation"></a></p></div></div>
+<div class="section">
+<h3><a name="Representation_in_the_Repository"></a>Representation in the Repository</h3>
<p>As of Oak 1.0 all privilege definitions are stored in the repository itself underneath <tt>/jcr:system/rep:privileges</tt>. The following privilege related built-in node types have been added in OAK 1.0 in order to represent built-in and custom privilege definitions.</p>
-<div>
-<div>
-<pre class="source">[rep:Privileges]
+<div class="source">
+<div class="source"><pre class="prettyprint">[rep:Privileges]
+ * (rep:Privilege) = rep:Privilege protected ABORT
- rep:next (LONG) protected multiple mandatory
@@ -361,65 +348,120 @@ rep:indexDefinitionManagement
- rep:aggregates (NAME) protected multiple
- rep:bits (LONG) protected multiple mandatory
</pre></div></div>
-
<p>Note the protection status of all child items defined by these node type definitions as they prevent modification of the privilege definitions using regular JCR write operations.</p>
-<a name="validation"></a>
-### Validation
-
+<p><a name="validation"></a></p></div>
+<div class="section">
+<h3><a name="Validation"></a>Validation</h3>
<p>The consistency of this content structure is asserted by a dedicated <tt>PrivilegeValidator</tt>. The corresponding errors are all of type <tt>Constraint</tt> with the following codes:</p>
-<table border="0" class="table table-striped">
-<thead>
+<table border="0" class="table table-striped">
+ <thead>
+
<tr class="a">
-<th> Code </th>
-<th> Message </th></tr>
-</thead><tbody>
-
+
+<th>Code </th>
+
+<th>Message </th>
+ </tr>
+ </thead>
+ <tbody>
+
<tr class="b">
-<td> 0041 </td>
-<td> Modification of existing privilege definition X </td></tr>
+
+<td>0041 </td>
+
+<td>Modification of existing privilege definition X </td>
+ </tr>
+
<tr class="a">
-<td> 0042 </td>
-<td> Un-register privilege X </td></tr>
+
+<td>0042 </td>
+
+<td>Un-register privilege X </td>
+ </tr>
+
<tr class="b">
-<td> 0043 </td>
-<td> Next bits not updated </td></tr>
+
+<td>0043 </td>
+
+<td>Next bits not updated </td>
+ </tr>
+
<tr class="a">
-<td> 0044 </td>
-<td> Privilege store not initialized </td></tr>
+
+<td>0044 </td>
+
+<td>Privilege store not initialized </td>
+ </tr>
+
<tr class="b">
-<td> 0045 </td>
-<td> Modification of existing privilege definition X </td></tr>
+
+<td>0045 </td>
+
+<td>Modification of existing privilege definition X </td>
+ </tr>
+
<tr class="a">
-<td> 0046 </td>
-<td> Modification of existing privilege definition X </td></tr>
+
+<td>0046 </td>
+
+<td>Modification of existing privilege definition X </td>
+ </tr>
+
<tr class="b">
-<td> 0047 </td>
-<td> Invalid declared aggregate name X </td></tr>
+
+<td>0047 </td>
+
+<td>Invalid declared aggregate name X </td>
+ </tr>
+
<tr class="a">
-<td> 0048 </td>
-<td> PrivilegeBits are missing </td></tr>
+
+<td>0048 </td>
+
+<td>PrivilegeBits are missing </td>
+ </tr>
+
<tr class="b">
-<td> 0049 </td>
-<td> PrivilegeBits already in used </td></tr>
+
+<td>0049 </td>
+
+<td>PrivilegeBits already in used </td>
+ </tr>
+
<tr class="a">
-<td> 0050 </td>
-<td> Singular aggregation is equivalent to existing privilege.</td></tr>
+
+<td>0050 </td>
+
+<td>Singular aggregation is equivalent to existing privilege.</td>
+ </tr>
+
<tr class="b">
-<td> 0051 </td>
-<td> Declared aggregate X is not a registered privilege </td></tr>
+
+<td>0051 </td>
+
+<td>Declared aggregate X is not a registered privilege </td>
+ </tr>
+
<tr class="a">
-<td> 0052 </td>
-<td> Detected circular aggregation </td></tr>
+
+<td>0052 </td>
+
+<td>Detected circular aggregation </td>
+ </tr>
+
<tr class="b">
-<td> 0053 </td>
-<td> Custom aggregate privilege X is already covered. </td></tr>
-</tbody>
+
+<td>0053 </td>
+
+<td>Custom aggregate privilege X is already covered. </td>
+ </tr>
+ </tbody>
</table>
-<a name="configuration"></a>
-### Configuration
-
-<p>There are no implementation specific configuration options associated with the privilege management implementation.</p></div></div></div>
+<p><a name="configuration"></a></p></div>
+<div class="section">
+<h3><a name="Configuration"></a>Configuration</h3>
+<p>There are no implementation specific configuration options associated with the privilege management implementation.</p></div></div>
</div>
</div>
</div>
Modified: jackrabbit/site/live/oak/docs/security/privilege/differences.html
URL: http://svn.apache.org/viewvc/jackrabbit/site/live/oak/docs/security/privilege/differences.html?rev=1839663&r1=1839662&r2=1839663&view=diff
==============================================================================
--- jackrabbit/site/live/oak/docs/security/privilege/differences.html (original)
+++ jackrabbit/site/live/oak/docs/security/privilege/differences.html Thu Aug 30 11:48:45 2018
@@ -1,13 +1,13 @@
<!DOCTYPE html>
<!--
- | Generated by Apache Maven Doxia Site Renderer 1.8.1 at 2018-08-29
+ | Generated by Apache Maven Doxia Site Renderer 1.7.4 at 2018-02-21
| Rendered using Apache Maven Fluido Skin 1.6
-->
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
- <meta name="Date-Revision-yyyymmdd" content="20180829" />
+ <meta name="Date-Revision-yyyymmdd" content="20180221" />
<meta http-equiv="Content-Language" content="en" />
<title>Jackrabbit Oak – Privilege Management : Differences wrt Jackrabbit 2.x</title>
<link rel="stylesheet" href="../../css/apache-maven-fluido-1.6.min.css" />
@@ -52,7 +52,6 @@
<a href="#" class="dropdown-toggle" data-toggle="dropdown">Main APIs <b class="caret"></b></a>
<ul class="dropdown-menu">
<li><a href="http://www.day.com/specs/jcr/2.0/index.html" title="JCR API">JCR API</a></li>
- <li><a href="https://jackrabbit.apache.org/jcr/jcr-api.html" title="Jackrabbit API">Jackrabbit API</a></li>
<li><a href="../../oak_api/overview.html" title="Oak API">Oak API</a></li>
</ul>
</li>
@@ -67,12 +66,7 @@
<li><a href="../../nodestore/compositens.html" title="Composite NodeStore">Composite NodeStore</a></li>
</ul>
</li>
- <li class="dropdown-submenu">
-<a href="../../plugins/blobstore.html" title="Blob Storage">Blob Storage</a>
- <ul class="dropdown-menu">
- <li><a href="../../features/direct-binary-access.html" title="Direct Binary Access">Direct Binary Access</a></li>
- </ul>
- </li>
+ <li><a href="../../plugins/blobstore.html" title="Blob Storage">Blob Storage</a></li>
<li class="dropdown-submenu">
<a href="../../query/query.html" title="Query">Query</a>
<ul class="dropdown-menu">
@@ -142,7 +136,7 @@
<div id="breadcrumbs">
<ul class="breadcrumb">
- <li id="publishDate">Last Published: 2018-08-29<span class="divider">|</span>
+ <li id="publishDate">Last Published: 2018-02-21<span class="divider">|</span>
</li>
<li id="projectVersion">Version: 1.10-SNAPSHOT</li>
</ul>
@@ -161,14 +155,12 @@
<li><a href="../../architecture/nodestate.html" title="The Node State Model"><span class="none"></span>The Node State Model</a> </li>
<li class="nav-header">Main APIs</li>
<li><a href="http://www.day.com/specs/jcr/2.0/index.html" class="externalLink" title="JCR API"><span class="none"></span>JCR API</a> </li>
- <li><a href="https://jackrabbit.apache.org/jcr/jcr-api.html" class="externalLink" title="Jackrabbit API"><span class="none"></span>Jackrabbit API</a> </li>
<li><a href="../../oak_api/overview.html" title="Oak API"><span class="none"></span>Oak API</a> </li>
<li class="nav-header">Features and Plugins</li>
<li><a href="../../nodestore/overview.html" title="Node Storage"><span class="icon-chevron-down"></span>Node Storage</a>
<ul class="nav nav-list">
<li><a href="../../nodestore/documentmk.html" title="Document NodeStore"><span class="icon-chevron-down"></span>Document NodeStore</a>
<ul class="nav nav-list">
- <li><a href="../../nodestore/document/mongo-document-store.html" title="MongoDB DocumentStore"><span class="none"></span>MongoDB DocumentStore</a> </li>
<li><a href="../../nodestore/document/node-bundling.html" title="Node Bundling"><span class="none"></span>Node Bundling</a> </li>
<li><a href="../../nodestore/document/secondary-store.html" title="Secondary Store"><span class="none"></span>Secondary Store</a> </li>
<li><a href="../../nodestore/persistent-cache.html" title="Persistent Cache"><span class="none"></span>Persistent Cache</a> </li>
@@ -179,11 +171,7 @@
<li><a href="../../nodestore/compositens.html" title="Composite NodeStore"><span class="none"></span>Composite NodeStore</a> </li>
</ul>
</li>
- <li><a href="../../plugins/blobstore.html" title="Blob Storage"><span class="icon-chevron-down"></span>Blob Storage</a>
- <ul class="nav nav-list">
- <li><a href="../../features/direct-binary-access.html" title="Direct Binary Access"><span class="none"></span>Direct Binary Access</a> </li>
- </ul>
- </li>
+ <li><a href="../../plugins/blobstore.html" title="Blob Storage"><span class="none"></span>Blob Storage</a> </li>
<li><a href="../../query/query.html" title="Query"><span class="icon-chevron-down"></span>Query</a>
<ul class="nav nav-list">
<li><a href="../../query/query-engine.html" title="Query Engine"><span class="none"></span>Query Engine</a> </li>
@@ -251,42 +239,52 @@
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
- -->
-<div class="section">
+ --><div class="section">
<div class="section">
<h3><a name="Privilege_Management_:_Differences_wrt_Jackrabbit_2.x"></a>Privilege Management : Differences wrt Jackrabbit 2.x</h3>
<div class="section">
<h4><a name="Registration_of_Custom_Privileges"></a>Registration of Custom Privileges</h4>
<p>As far as registration of custom privileges the Oak implementation behaves different to Jackrabbit 2.x in the following two aspects:</p>
-<ul>
+<ul>
+
<li>Registration of new privileges fails with <tt>IllegalStateException</tt> if the editing session has pending changes.</li>
+
<li>Any validation is performed by CommitHooks in order to make sure that modifications made on the Oak API directly is equally verified. Subsequently any violation (permission, privilege consistency) is only detected at the end of the registration process. The privilege manager itself does not perform any validation.</li>
</ul></div>
<div class="section">
<h4><a name="Built-in_Privilege_Definitions"></a>Built-in Privilege Definitions</h4>
<p>The following changes have been made to built-in privilege definitions:</p>
-<ul>
+<ul>
+
<li>Modifications:
+
<ul>
-
+
<li><tt>jcr:read</tt> is now an aggregation of <tt>rep:readNodes</tt> and <tt>rep:readProperties</tt></li>
+
<li><tt>jcr:modifyProperties</tt> is now an aggregation of <tt>rep:addProperties</tt>, <tt>rep:alterProperties</tt> and <tt>rep:removeProperties</tt></li>
-</ul>
-</li>
+ </ul></li>
+
<li>New Privileges defined by Oak 1.0:
+
<ul>
-
+
<li><tt>rep:userManagement</tt></li>
+
<li><tt>rep:readNodes</tt></li>
+
<li><tt>rep:readProperties</tt></li>
+
<li><tt>rep:addProperties</tt></li>
+
<li><tt>rep:alterProperties</tt></li>
+
<li><tt>rep:removeProperties</tt></li>
+
<li><tt>rep:indexDefinitionManagement</tt></li>
-</ul>
-</li>
+ </ul></li>
</ul></div></div></div>
</div>
</div>
Modified: jackrabbit/site/live/oak/docs/security/privilege/mappingtoitems.html
URL: http://svn.apache.org/viewvc/jackrabbit/site/live/oak/docs/security/privilege/mappingtoitems.html?rev=1839663&r1=1839662&r2=1839663&view=diff
==============================================================================
--- jackrabbit/site/live/oak/docs/security/privilege/mappingtoitems.html (original)
+++ jackrabbit/site/live/oak/docs/security/privilege/mappingtoitems.html Thu Aug 30 11:48:45 2018
@@ -1,13 +1,13 @@
<!DOCTYPE html>
<!--
- | Generated by Apache Maven Doxia Site Renderer 1.8.1 at 2018-08-29
+ | Generated by Apache Maven Doxia Site Renderer 1.7.4 at 2018-02-21
| Rendered using Apache Maven Fluido Skin 1.6
-->
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
- <meta name="Date-Revision-yyyymmdd" content="20180829" />
+ <meta name="Date-Revision-yyyymmdd" content="20180221" />
<meta http-equiv="Content-Language" content="en" />
<title>Jackrabbit Oak – Privilege Management : Mapping Privileges to Items</title>
<link rel="stylesheet" href="../../css/apache-maven-fluido-1.6.min.css" />
@@ -52,7 +52,6 @@
<a href="#" class="dropdown-toggle" data-toggle="dropdown">Main APIs <b class="caret"></b></a>
<ul class="dropdown-menu">
<li><a href="http://www.day.com/specs/jcr/2.0/index.html" title="JCR API">JCR API</a></li>
- <li><a href="https://jackrabbit.apache.org/jcr/jcr-api.html" title="Jackrabbit API">Jackrabbit API</a></li>
<li><a href="../../oak_api/overview.html" title="Oak API">Oak API</a></li>
</ul>
</li>
@@ -67,12 +66,7 @@
<li><a href="../../nodestore/compositens.html" title="Composite NodeStore">Composite NodeStore</a></li>
</ul>
</li>
- <li class="dropdown-submenu">
-<a href="../../plugins/blobstore.html" title="Blob Storage">Blob Storage</a>
- <ul class="dropdown-menu">
- <li><a href="../../features/direct-binary-access.html" title="Direct Binary Access">Direct Binary Access</a></li>
- </ul>
- </li>
+ <li><a href="../../plugins/blobstore.html" title="Blob Storage">Blob Storage</a></li>
<li class="dropdown-submenu">
<a href="../../query/query.html" title="Query">Query</a>
<ul class="dropdown-menu">
@@ -142,7 +136,7 @@
<div id="breadcrumbs">
<ul class="breadcrumb">
- <li id="publishDate">Last Published: 2018-08-29<span class="divider">|</span>
+ <li id="publishDate">Last Published: 2018-02-21<span class="divider">|</span>
</li>
<li id="projectVersion">Version: 1.10-SNAPSHOT</li>
</ul>
@@ -161,14 +155,12 @@
<li><a href="../../architecture/nodestate.html" title="The Node State Model"><span class="none"></span>The Node State Model</a> </li>
<li class="nav-header">Main APIs</li>
<li><a href="http://www.day.com/specs/jcr/2.0/index.html" class="externalLink" title="JCR API"><span class="none"></span>JCR API</a> </li>
- <li><a href="https://jackrabbit.apache.org/jcr/jcr-api.html" class="externalLink" title="Jackrabbit API"><span class="none"></span>Jackrabbit API</a> </li>
<li><a href="../../oak_api/overview.html" title="Oak API"><span class="none"></span>Oak API</a> </li>
<li class="nav-header">Features and Plugins</li>
<li><a href="../../nodestore/overview.html" title="Node Storage"><span class="icon-chevron-down"></span>Node Storage</a>
<ul class="nav nav-list">
<li><a href="../../nodestore/documentmk.html" title="Document NodeStore"><span class="icon-chevron-down"></span>Document NodeStore</a>
<ul class="nav nav-list">
- <li><a href="../../nodestore/document/mongo-document-store.html" title="MongoDB DocumentStore"><span class="none"></span>MongoDB DocumentStore</a> </li>
<li><a href="../../nodestore/document/node-bundling.html" title="Node Bundling"><span class="none"></span>Node Bundling</a> </li>
<li><a href="../../nodestore/document/secondary-store.html" title="Secondary Store"><span class="none"></span>Secondary Store</a> </li>
<li><a href="../../nodestore/persistent-cache.html" title="Persistent Cache"><span class="none"></span>Persistent Cache</a> </li>
@@ -179,11 +171,7 @@
<li><a href="../../nodestore/compositens.html" title="Composite NodeStore"><span class="none"></span>Composite NodeStore</a> </li>
</ul>
</li>
- <li><a href="../../plugins/blobstore.html" title="Blob Storage"><span class="icon-chevron-down"></span>Blob Storage</a>
- <ul class="nav nav-list">
- <li><a href="../../features/direct-binary-access.html" title="Direct Binary Access"><span class="none"></span>Direct Binary Access</a> </li>
- </ul>
- </li>
+ <li><a href="../../plugins/blobstore.html" title="Blob Storage"><span class="none"></span>Blob Storage</a> </li>
<li><a href="../../query/query.html" title="Query"><span class="icon-chevron-down"></span>Query</a>
<ul class="nav nav-list">
<li><a href="../../query/query-engine.html" title="Query Engine"><span class="none"></span>Query Engine</a> </li>
@@ -251,156 +239,271 @@
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
- -->
-<div class="section">
+ --><div class="section">
<div class="section">
<h3><a name="Privilege_Management_:_Mapping_Privileges_to_Items"></a>Privilege Management : Mapping Privileges to Items</h3>
<p>The following table allows to identify which items will be affected by the invididual built in privileges.</p>
<p>Note: the term <i>regular</i> is used on contrast to <i>protected</i> items that are written using special API calls and thus mandate special privileges or are maintained by the system only and cannot be modified by the API consumer.</p>
<div class="section">
<h4><a name="Read"></a>Read</h4>
-<table border="0" class="table table-striped">
-<thead>
-
-<tr class="a">
-<th> Privilege </th>
-<th> Affected Items </th></tr>
-</thead><tbody>
-<tr class="b">
-<td> rep:readNodes </td>
-<td> all nodes except for access control content </td></tr>
+<table border="0" class="table table-striped">
+ <thead>
+
<tr class="a">
-<td> rep:readProperties </td>
-<td> all properties except for access control content </td></tr>
-<tr class="b">
-<td> jcr:readAccessControl </td>
-<td> all items defining access control content (see below) </td></tr>
-</tbody>
+
+<th>Privilege </th>
+
+<th>Affected Items </th>
+ </tr>
+ </thead>
+ <tbody>
+
+<tr class="b">
+
+<td>rep:readNodes </td>
+
+<td>all nodes except for access control content </td>
+ </tr>
+
+<tr class="a">
+
+<td>rep:readProperties </td>
+
+<td>all properties except for access control content </td>
+ </tr>
+
+<tr class="b">
+
+<td>jcr:readAccessControl </td>
+
+<td>all items defining access control content (see below) </td>
+ </tr>
+ </tbody>
</table></div>
<div class="section">
<h4><a name="Writing_Properties"></a>Writing Properties</h4>
-<table border="0" class="table table-striped">
-<thead>
-
-<tr class="a">
-<th> Privilege </th>
-<th> Affected Items </th></tr>
-</thead><tbody>
-<tr class="b">
-<td> rep:addProperties </td>
-<td> creation of new regular properties </td></tr>
+<table border="0" class="table table-striped">
+ <thead>
+
<tr class="a">
-<td> rep:alterProperties </td>
-<td> changing existing regular properties </td></tr>
-<tr class="b">
-<td> rep:removeProperties </td>
-<td> removing existing regular properties </td></tr>
-</tbody>
+
+<th>Privilege </th>
+
+<th>Affected Items </th>
+ </tr>
+ </thead>
+ <tbody>
+
+<tr class="b">
+
+<td>rep:addProperties </td>
+
+<td>creation of new regular properties </td>
+ </tr>
+
+<tr class="a">
+
+<td>rep:alterProperties </td>
+
+<td>changing existing regular properties </td>
+ </tr>
+
+<tr class="b">
+
+<td>rep:removeProperties </td>
+
+<td>removing existing regular properties </td>
+ </tr>
+ </tbody>
</table></div>
<div class="section">
<h4><a name="Writing_Nodes"></a>Writing Nodes</h4>
-<table border="0" class="table table-striped">
-<thead>
-
-<tr class="a">
-<th> Privilege </th>
-<th> Affected Items </th></tr>
-</thead><tbody>
-<tr class="b">
-<td> jcr:addChildNodes </td>
-<td> granted on parent to create new regular child nodes </td></tr>
-<tr class="a">
-<td> jcr:removeChildNodes </td>
-<td> granted on parent to remove regular child nodes </td></tr>
-<tr class="b">
-<td> rep:removeNode </td>
-<td> required to be granted on regular nodes for removal </td></tr>
+<table border="0" class="table table-striped">
+ <thead>
+
<tr class="a">
-<td> jcr:nodeTypeManagement</td>
-<td> explicitly setting or modifying node type information on a regular (non-protected) node; affected properties are <tt>jcr:primaryType</tt>, <tt>jcr:mixinTypes</tt> </td></tr>
-</tbody>
+
+<th>Privilege </th>
+
+<th>Affected Items </th>
+ </tr>
+ </thead>
+ <tbody>
+
+<tr class="b">
+
+<td>jcr:addChildNodes </td>
+
+<td>granted on parent to create new regular child nodes </td>
+ </tr>
+
+<tr class="a">
+
+<td>jcr:removeChildNodes </td>
+
+<td>granted on parent to remove regular child nodes </td>
+ </tr>
+
+<tr class="b">
+
+<td>rep:removeNode </td>
+
+<td>required to be granted on regular nodes for removal </td>
+ </tr>
+
+<tr class="a">
+
+<td>jcr:nodeTypeManagement</td>
+
+<td>explicitly setting or modifying node type information on a regular (non-protected) node; affected properties are <tt>jcr:primaryType</tt>, <tt>jcr:mixinTypes</tt> </td>
+ </tr>
+ </tbody>
</table></div>
<div class="section">
<h4><a name="Access_Control_Management"></a>Access Control Management</h4>
-<table border="0" class="table table-striped">
-<thead>
+<table border="0" class="table table-striped">
+ <thead>
+
<tr class="a">
-<th> Privilege </th>
-<th> Affected Items </th></tr>
-</thead><tbody>
-
-<tr class="b">
-<td> jcr:readAccessControl </td>
-<td> all items defining access control content [1] </td></tr>
-<tr class="a">
-<td> jcr:modifyAccessControl </td>
-<td> all items defining access control content [1] </td></tr>
-<tr class="b">
-<td> rep:privilegeManagement </td>
-<td> implementation specific; in Oak everything below <tt>/jcr:system/rep:privileges</tt> </td></tr>
-</tbody>
+
+<th>Privilege </th>
+
+<th>Affected Items </th>
+ </tr>
+ </thead>
+ <tbody>
+
+<tr class="b">
+
+<td>jcr:readAccessControl </td>
+
+<td>all items defining access control content [1] </td>
+ </tr>
+
+<tr class="a">
+
+<td>jcr:modifyAccessControl </td>
+
+<td>all items defining access control content [1] </td>
+ </tr>
+
+<tr class="b">
+
+<td>rep:privilegeManagement </td>
+
+<td>implementation specific; in Oak everything below <tt>/jcr:system/rep:privileges</tt> </td>
+ </tr>
+ </tbody>
</table></div>
<div class="section">
<h4><a name="Other_Session_and_Workspace_Operations"></a>Other Session and Workspace Operations</h4>
-<table border="0" class="table table-striped">
-<thead>
+<table border="0" class="table table-striped">
+ <thead>
+
<tr class="a">
-<th> Privilege </th>
-<th> Affected Items </th></tr>
-</thead><tbody>
-
-<tr class="b">
-<td> jcr:versionManagement </td>
-<td> all items defining version content [2] </td></tr>
-<tr class="a">
-<td> jcr:lockManagement </td>
-<td> Properties <tt>jcr:lockIsDeep</tt>, <tt>jcr:lockOwner</tt> </td></tr>
-<tr class="b">
-<td> jcr:lifecycleManagement </td>
-<td> <tt>jcr:lifecyclePolicy</tt>, <tt>jcr:currentLifecycleState</tt> </td></tr>
-<tr class="a">
-<td> jcr:retentionManagement </td>
-<td> implementation specific, in Jackrabbit 2.x the following properties: <tt>rep:hold</tt>, <tt>rep:retentionPolicy</tt>, Oak: NA </td></tr>
-<tr class="b">
-<td> rep:userManagement </td>
-<td> all items defining user/group content [3] </td></tr>
-<tr class="a">
-<td> rep:indexDefinitionManagement </td>
-<td> implementation specific; in Oak trees starting with an <tt>oak:index</tt> node </td></tr>
-</tbody>
+
+<th>Privilege </th>
+
+<th>Affected Items </th>
+ </tr>
+ </thead>
+ <tbody>
+
+<tr class="b">
+
+<td>jcr:versionManagement </td>
+
+<td>all items defining version content [2] </td>
+ </tr>
+
+<tr class="a">
+
+<td>jcr:lockManagement </td>
+
+<td>Properties <tt>jcr:lockIsDeep</tt>, <tt>jcr:lockOwner</tt> </td>
+ </tr>
+
+<tr class="b">
+
+<td>jcr:lifecycleManagement </td>
+
+<td><tt>jcr:lifecyclePolicy</tt>, <tt>jcr:currentLifecycleState</tt> </td>
+ </tr>
+
+<tr class="a">
+
+<td>jcr:retentionManagement </td>
+
+<td>implementation specific, in Jackrabbit 2.x the following properties: <tt>rep:hold</tt>, <tt>rep:retentionPolicy</tt>, Oak: NA </td>
+ </tr>
+
+<tr class="b">
+
+<td>rep:userManagement </td>
+
+<td>all items defining user/group content [3] </td>
+ </tr>
+
+<tr class="a">
+
+<td>rep:indexDefinitionManagement </td>
+
+<td>implementation specific; in Oak trees starting with an <tt>oak:index</tt> node </td>
+ </tr>
+ </tbody>
</table></div>
<div class="section">
<h4><a name="Repository_Operations"></a>Repository Operations</h4>
-<table border="0" class="table table-striped">
-<thead>
+<table border="0" class="table table-striped">
+ <thead>
+
<tr class="a">
-<th> Privilege </th>
-<th> Affected Items </th></tr>
-</thead><tbody>
-
-<tr class="b">
-<td> jcr:namespaceManagement </td>
-<td> implementation specific; in Oak everything below <tt>/jcr:system/rep:namespaces</tt> </td></tr>
-<tr class="a">
-<td> jcr:nodeTypeDefinitionManagement </td>
-<td> implementation specific; in Oak everything below <tt>/jcr:system/jcr:nodeTypes</tt> </td></tr>
-<tr class="b">
-<td> rep:privilegeManagement </td>
-<td> implementation specific; in Oak everything below <tt>/jcr:system/rep:privileges</tt> </td></tr>
-<tr class="a">
-<td> jcr:workspaceManagement </td>
-<td> NA </td></tr>
-</tbody>
+
+<th>Privilege </th>
+
+<th>Affected Items </th>
+ </tr>
+ </thead>
+ <tbody>
+
+<tr class="b">
+
+<td>jcr:namespaceManagement </td>
+
+<td>implementation specific; in Oak everything below <tt>/jcr:system/rep:namespaces</tt> </td>
+ </tr>
+
+<tr class="a">
+
+<td>jcr:nodeTypeDefinitionManagement </td>
+
+<td>implementation specific; in Oak everything below <tt>/jcr:system/jcr:nodeTypes</tt> </td>
+ </tr>
+
+<tr class="b">
+
+<td>rep:privilegeManagement </td>
+
+<td>implementation specific; in Oak everything below <tt>/jcr:system/rep:privileges</tt> </td>
+ </tr>
+
+<tr class="a">
+
+<td>jcr:workspaceManagement </td>
+
+<td>NA </td>
+ </tr>
+ </tbody>
</table></div>
<div class="section">
<h4><a name="Annotations"></a>Annotations</h4>
-<p>[1] In Oak reading/writing nodes with the following node types provided by the implementations present: <tt>rep:Policy</tt>, <tt>rep:ACL</tt>, <tt>rep:ACE</tt>, <tt>rep:GrantACE</tt>, <tt>rep:DenyACE</tt>, <tt>rep:Restrictions</tt> and <tt>rep:CugPolicy</tt> and all protected items defined therein. See <a href="../accesscontrol/default.html">Default Access Control Management</a> and <a href="../authorization/cug.html">Managing Access Control with CUG</a>, respectively.</p>
+<p>[1] In Oak reading/writing nodes with the following node types provided by the implementations present: <tt>rep:Policy</tt>, <tt>rep:ACL</tt>, <tt>rep:ACE</tt>, <tt>rep:GrantACE</tt>, <tt>rep:DenyACE</tt>, <tt>rep:Restrictions</tt> and <tt>rep:CugPolicy</tt> and all protected items defined therein. See <a href="../accesscontrol/default.html">Default Access Control Management</a> and <a href="../authorization/cug.html">Managing Access Control with CUG</a>, respectively.</p>
<p>[2] Granting jcr:versionManagement privilege at a given versionable node will allow writing items through JCR version management API which writes below <tt>/jcr:system/jcr:versionStorage</tt>, <tt>/jcr:system/jcr:activities</tt>, <tt>/jcr:system/jcr:configurations</tt> and the following properties both in the storage(s) and with the versionable node: <tt>jcr:activity</tt>, <tt>jcr:activityTitle</tt>, <tt>jcr:baseVersion</tt>, <tt>jcr:childVersionHistory</tt>, <tt>jcr:configuration</tt>, <tt>jcr:copiedFrom</tt>, <tt>jcr:frozenMixinTypes</tt>, <tt>jcr:frozenPrimaryType</tt>, <tt>jcr:frozenUuid</tt>, <tt>jcr:isCheckedOut</tt>, <tt>jcr:mergeFailed</tt>, <tt>jcr:predecessors</tt>,<tt>jcr:successors</tt>,<tt>jcr:root</tt>,<tt>jcr:versionableUuid</tt>, <tt>jcr:versionHistory</tt></p>
<p>[3] in Oak creating nodes with the following primary types: <tt>rep:User</tt>, <tt>rep:SystemUser</tt>, <tt>rep:Group</tt>, <tt>rep:Impersonatable</tt>, <tt>rep:Members</tt>, <tt>rep:MemberReferences</tt>, <tt>rep:MemberReferencesList</tt>, <tt>rep:Password</tt> and all protected properties defined therein</p></div></div></div>
</div>