How should a Custom AccessManager access a Node ?

[Sriram Narayanan <sr...@gmail.com>]

Hello:

For a project that I am working on, I need to write an AccessManager
such that it locates a given Node (from the NodeId), checks the Node
for a few attributes, and then grants access to that Node.

I have read http://issues.apache.org/jira/browse/JCR-478?page=comments#action_12420820
and I realize that AccessManager is by intent restricted from
accessing Content Repository data.

However, I still do need to access the Node that has the given NodeId.
I am about to try accessing the Session via JNDI.

Are there any other recommendations on writing AccessManagers ?

Thanks in advance.

-- Sriram

Re: How should a Custom AccessManager access a Node ?

[Torgeir Veimo <to...@pobox.com>]

On 9 Oct 2006, at 21:32, Michael Neale wrote:

> right, so this means not keeping ACL data on the node itself, as  
> Sriram
> suggests?
>
> I guess you need seperate nodes to store the ACL data (stored  
> against the
> UUIDs of the nodes you are protecting) and on startup, load that up  
> into a
> dirty big in memory map, which the ACL uses.

No I actually store ACLs as sub nodes. I have registered a change  
listener on the node types for the ACLs. The only thing missing from  
my current implementation is an actual AccesManager; it's currently  
being done by a legacy component from our old repository code.

> When you add/modify a node, you need to update the ACL data nodes,  
> and flush
> its cache (or something like that).

Yes.

It's technically possible to let your access manager have its own  
special session open to retrieve nodes on demand though; an ACL cache  
is not the only way to implement this.

-- 
Torgeir Veimo
torgeir@pobox.com

Re: How should a Custom AccessManager access a Node ?

[Michael Neale <mi...@gmail.com>]

right, so this means not keeping ACL data on the node itself, as Sriram
suggests?

I guess you need seperate nodes to store the ACL data (stored against the
UUIDs of the nodes you are protecting) and on startup, load that up into a
dirty big in memory map, which the ACL uses.

When you add/modify a node, you need to update the ACL data nodes, and flush
its cache (or something like that).

Does that sound reasonable?

On 10/9/06, Torgeir Veimo <to...@pobox.com> wrote:
>
>
> On 9 Oct 2006, at 10:52, Sriram Narayanan wrote:
>
> > Are there any other recommendations on writing AccessManagers ?
>
> The recommended strategy is to cache the ACL info on startup, and
> have a listener that updates the cached data on node updated/deletes.
> This listener would be set up using a session that has full access to
> the repository.
>
> There hasn't been posted any example code to the list yet though.
>
> --
> Torgeir Veimo
> torgeir@pobox.com
>
>
>
>

Re: How should a Custom AccessManager access a Node ?

[Torgeir Veimo <to...@pobox.com>]

On 9 Oct 2006, at 10:52, Sriram Narayanan wrote:

> Are there any other recommendations on writing AccessManagers ?

The recommended strategy is to cache the ACL info on startup, and  
have a listener that updates the cached data on node updated/deletes.  
This listener would be set up using a session that has full access to  
the repository.

There hasn't been posted any example code to the list yet though.

-- 
Torgeir Veimo
torgeir@pobox.com