You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@jackrabbit.apache.org by an...@apache.org on 2016/02/12 18:09:07 UTC
svn commit: r1730074 [5/8] - in /jackrabbit/site/live/oak/docs: ./ META-INF/
architecture/ coldstandby/ features/ nodestore/ nodestore/segment/
oak-mongo-js/ oak_api/ plugins/ query/ security/ security/accesscontrol/
security/authentication/ security/a...
Added: jackrabbit/site/live/oak/docs/security/authorization/restriction.html
URL: http://svn.apache.org/viewvc/jackrabbit/site/live/oak/docs/security/authorization/restriction.html?rev=1730074&view=auto
==============================================================================
--- jackrabbit/site/live/oak/docs/security/authorization/restriction.html (added)
+++ jackrabbit/site/live/oak/docs/security/authorization/restriction.html Fri Feb 12 17:09:05 2016
@@ -0,0 +1,918 @@
+<!DOCTYPE html>
+<!--
+ | Generated by Apache Maven Doxia at 2016-02-10
+ | Rendered using Apache Maven Fluido Skin 1.3.0
+-->
+<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
+ <head>
+ <meta charset="UTF-8" />
+ <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+ <meta name="Date-Revision-yyyymmdd" content="20160210" />
+ <meta http-equiv="Content-Language" content="en" />
+ <title>Jackrabbit Oak - Restriction Management</title>
+ <link rel="stylesheet" href="../../css/apache-maven-fluido-1.3.0.min.css" />
+ <link rel="stylesheet" href="../../css/site.css" />
+ <link rel="stylesheet" href="../../css/print.css" media="print" />
+
+
+ <script type="text/javascript" src="../../js/apache-maven-fluido-1.3.0.min.js"></script>
+
+
+ </head>
+ <body class="topBarEnabled">
+
+
+
+
+
+
+ <a href="http://github.com/apache/jackrabbit-oak">
+ <img style="position: absolute; top: 0; right: 0; border: 0; z-index: 10000;"
+ src="https://s3.amazonaws.com/github/ribbons/forkme_right_red_aa0000.png"
+ alt="Fork me on GitHub">
+ </a>
+
+
+
+
+
+ <div id="topbar" class="navbar navbar-fixed-top ">
+ <div class="navbar-inner">
+ <div class="container-fluid">
+ <a data-target=".nav-collapse" data-toggle="collapse" class="btn btn-navbar">
+ <span class="icon-bar"></span>
+ <span class="icon-bar"></span>
+ <span class="icon-bar"></span>
+ </a>
+
+ <a class="brand" href="../../" title="Oak logo">
+
+
+ <img src="../../oak_logo.png" alt="Oak logo" />
+
+ </a>
+
+ <ul class="nav">
+ <li class="dropdown">
+ <a href="#" class="dropdown-toggle" data-toggle="dropdown">Overview <b class="caret"></b></a>
+ <ul class="dropdown-menu">
+
+ <li> <a href="../../index.html" title="Jackrabbit Oak">Jackrabbit Oak</a>
+</li>
+
+ <li> <a href="../../license.html" title="License">License</a>
+</li>
+
+ <li> <a href="../../downloads.html" title="Downloads">Downloads</a>
+</li>
+ </ul>
+ </li>
+ <li class="dropdown">
+ <a href="#" class="dropdown-toggle" data-toggle="dropdown">Concepts and Architecture <b class="caret"></b></a>
+ <ul class="dropdown-menu">
+
+ <li> <a href="../../architecture/overview.html" title="Overview">Overview</a>
+</li>
+
+ <li> <a href="../../architecture/nodestate.html" title="The Node State Model">The Node State Model</a>
+</li>
+ </ul>
+ </li>
+ <li class="dropdown">
+ <a href="#" class="dropdown-toggle" data-toggle="dropdown">Main APIs <b class="caret"></b></a>
+ <ul class="dropdown-menu">
+
+ <li> <a href="http://www.day.com/specs/jcr/2.0/index.html" title="JCR API">JCR API</a>
+</li>
+
+ <li> <a href="../../oak_api/overview.html" title="Oak API">Oak API</a>
+</li>
+ </ul>
+ </li>
+ <li class="dropdown">
+ <a href="#" class="dropdown-toggle" data-toggle="dropdown">Features and Plugins <b class="caret"></b></a>
+ <ul class="dropdown-menu">
+
+ <li> <a href="../../features/atomic-counter.html" title="Atomic Counter">Atomic Counter</a>
+</li>
+
+ <li> <a href="../../plugins/blobstore.html" title="Blob Storage">Blob Storage</a>
+</li>
+
+ <li> <a href="../../clustering.html" title="Clustering">Clustering</a>
+</li>
+
+ <li> <a href="../../nodestore/documentmk.html" title="DocumentNodeStore">DocumentNodeStore</a>
+</li>
+
+ <li> <a href="../../nodestore/overview.html" title="Node Storage">Node Storage</a>
+</li>
+
+ <li> <a href="../../nodestore/persistent-cache.html" title="Persistent Cache">Persistent Cache</a>
+</li>
+
+ <li> <a href="../../query/query.html" title="Query">Query</a>
+</li>
+
+ <li> <a href="../../security/overview.html" title="Security">Security</a>
+</li>
+
+ <li> <a href="../../nodestore/segment/overview.html" title="Segment Node Store">Segment Node Store</a>
+</li>
+ </ul>
+ </li>
+ <li class="dropdown">
+ <a href="#" class="dropdown-toggle" data-toggle="dropdown">Using Oak <b class="caret"></b></a>
+ <ul class="dropdown-menu">
+
+ <li> <a href="../../use_getting_started.html" title="Getting Started">Getting Started</a>
+</li>
+
+ <li> <a href="../../construct.html" title="Repository Construction">Repository Construction</a>
+</li>
+
+ <li> <a href="../../osgi_config.html" title="Configuring Oak">Configuring Oak</a>
+</li>
+
+ <li> <a href="../../command_line.html" title="Command Line Tools">Command Line Tools</a>
+</li>
+
+ <li> <a href="../../migration.html" title="Migration">Migration</a>
+</li>
+
+ <li> <a href="../../differences.html" title="Differences to Jackrabbit 2">Differences to Jackrabbit 2</a>
+</li>
+
+ <li> <a href="../../known_issues.html" title="Known Issues">Known Issues</a>
+</li>
+
+ <li> <a href="../../dos_and_donts.html" title="Dos and Don'ts">Dos and Don'ts</a>
+</li>
+
+ <li> <a href="../../coldstandby/coldstandby.html" title="Cold Standby">Cold Standby</a>
+</li>
+
+ <li> <a href="../../FAQ.html" title="FAQ">FAQ</a>
+</li>
+ </ul>
+ </li>
+ <li class="dropdown">
+ <a href="#" class="dropdown-toggle" data-toggle="dropdown">Developing Oak <b class="caret"></b></a>
+ <ul class="dropdown-menu">
+
+ <li> <a href="../../dev_getting_started.html" title="Getting Started">Getting Started</a>
+</li>
+
+ <li> <a href="../../participating.html" title="Participating">Participating</a>
+</li>
+
+ <li> <a href="../../developing-with-git.html" title="Developing with Git">Developing with Git</a>
+</li>
+
+ <li> <a href="../../diagnostic-builds.html" title="Cutting diagnostic builds">Cutting diagnostic builds</a>
+</li>
+
+ <li> <a href="../../attribution.html" title="Attribution">Attribution</a>
+</li>
+ </ul>
+ </li>
+ <li class="dropdown">
+ <a href="#" class="dropdown-toggle" data-toggle="dropdown">Links <b class="caret"></b></a>
+ <ul class="dropdown-menu">
+
+ <li> <a href="http://jackrabbit.apache.org/oak" title="Apache Jackrabbit Oak">Apache Jackrabbit Oak</a>
+</li>
+
+ <li> <a href="http://jackrabbit.apache.org/" title="Apache Jackrabbit">Apache Jackrabbit</a>
+</li>
+ </ul>
+ </li>
+ </ul>
+
+
+
+
+ </div>
+
+ </div>
+ </div>
+ </div>
+
+ <div class="container-fluid">
+ <div id="banner">
+ <div class="pull-left">
+ <div id="bannerLeft">
+ <h2>Oak Documentation</h2>
+ </div>
+ </div>
+ <div class="pull-right"> </div>
+ <div class="clear"><hr/></div>
+ </div>
+
+ <div id="breadcrumbs">
+ <ul class="breadcrumb">
+
+
+ <li id="publishDate">Last Published: 2016-02-10</li>
+ <li class="divider">|</li> <li id="projectVersion">Version: 1.4-SNAPSHOT</li>
+
+
+
+
+ </ul>
+ </div>
+
+
+ <div class="row-fluid">
+ <div id="leftColumn" class="span3">
+ <div class="well sidebar-nav">
+
+
+ <ul class="nav nav-list">
+ <li class="nav-header">Overview</li>
+
+ <li>
+
+ <a href="../../index.html" title="Jackrabbit Oak">
+ <i class="none"></i>
+ Jackrabbit Oak</a>
+ </li>
+
+ <li>
+
+ <a href="../../license.html" title="License">
+ <i class="none"></i>
+ License</a>
+ </li>
+
+ <li>
+
+ <a href="../../downloads.html" title="Downloads">
+ <i class="none"></i>
+ Downloads</a>
+ </li>
+ <li class="nav-header">Concepts and Architecture</li>
+
+ <li>
+
+ <a href="../../architecture/overview.html" title="Overview">
+ <i class="none"></i>
+ Overview</a>
+ </li>
+
+ <li>
+
+ <a href="../../architecture/nodestate.html" title="The Node State Model">
+ <i class="none"></i>
+ The Node State Model</a>
+ </li>
+ <li class="nav-header">Main APIs</li>
+
+ <li>
+
+ <a href="http://www.day.com/specs/jcr/2.0/index.html" class="externalLink" title="JCR API">
+ <i class="none"></i>
+ JCR API</a>
+ </li>
+
+ <li>
+
+ <a href="../../oak_api/overview.html" title="Oak API">
+ <i class="none"></i>
+ Oak API</a>
+ </li>
+ <li class="nav-header">Features and Plugins</li>
+
+ <li>
+
+ <a href="../../features/atomic-counter.html" title="Atomic Counter">
+ <i class="none"></i>
+ Atomic Counter</a>
+ </li>
+
+ <li>
+
+ <a href="../../plugins/blobstore.html" title="Blob Storage">
+ <i class="none"></i>
+ Blob Storage</a>
+ </li>
+
+ <li>
+
+ <a href="../../clustering.html" title="Clustering">
+ <i class="none"></i>
+ Clustering</a>
+ </li>
+
+ <li>
+
+ <a href="../../nodestore/documentmk.html" title="DocumentNodeStore">
+ <i class="none"></i>
+ DocumentNodeStore</a>
+ </li>
+
+ <li>
+
+ <a href="../../nodestore/overview.html" title="Node Storage">
+ <i class="none"></i>
+ Node Storage</a>
+ </li>
+
+ <li>
+
+ <a href="../../nodestore/persistent-cache.html" title="Persistent Cache">
+ <i class="none"></i>
+ Persistent Cache</a>
+ </li>
+
+ <li>
+
+ <a href="../../query/query.html" title="Query">
+ <i class="none"></i>
+ Query</a>
+ </li>
+
+ <li>
+
+ <a href="../../security/overview.html" title="Security">
+ <i class="none"></i>
+ Security</a>
+ </li>
+
+ <li>
+
+ <a href="../../nodestore/segment/overview.html" title="Segment Node Store">
+ <i class="none"></i>
+ Segment Node Store</a>
+ </li>
+ <li class="nav-header">Using Oak</li>
+
+ <li>
+
+ <a href="../../use_getting_started.html" title="Getting Started">
+ <i class="none"></i>
+ Getting Started</a>
+ </li>
+
+ <li>
+
+ <a href="../../construct.html" title="Repository Construction">
+ <i class="none"></i>
+ Repository Construction</a>
+ </li>
+
+ <li>
+
+ <a href="../../osgi_config.html" title="Configuring Oak">
+ <i class="none"></i>
+ Configuring Oak</a>
+ </li>
+
+ <li>
+
+ <a href="../../command_line.html" title="Command Line Tools">
+ <i class="none"></i>
+ Command Line Tools</a>
+ </li>
+
+ <li>
+
+ <a href="../../migration.html" title="Migration">
+ <i class="none"></i>
+ Migration</a>
+ </li>
+
+ <li>
+
+ <a href="../../differences.html" title="Differences to Jackrabbit 2">
+ <i class="none"></i>
+ Differences to Jackrabbit 2</a>
+ </li>
+
+ <li>
+
+ <a href="../../known_issues.html" title="Known Issues">
+ <i class="none"></i>
+ Known Issues</a>
+ </li>
+
+ <li>
+
+ <a href="../../dos_and_donts.html" title="Dos and Don'ts">
+ <i class="none"></i>
+ Dos and Don'ts</a>
+ </li>
+
+ <li>
+
+ <a href="../../coldstandby/coldstandby.html" title="Cold Standby">
+ <i class="none"></i>
+ Cold Standby</a>
+ </li>
+
+ <li>
+
+ <a href="../../FAQ.html" title="FAQ">
+ <i class="none"></i>
+ FAQ</a>
+ </li>
+ <li class="nav-header">Developing Oak</li>
+
+ <li>
+
+ <a href="../../dev_getting_started.html" title="Getting Started">
+ <i class="none"></i>
+ Getting Started</a>
+ </li>
+
+ <li>
+
+ <a href="../../participating.html" title="Participating">
+ <i class="none"></i>
+ Participating</a>
+ </li>
+
+ <li>
+
+ <a href="../../developing-with-git.html" title="Developing with Git">
+ <i class="none"></i>
+ Developing with Git</a>
+ </li>
+
+ <li>
+
+ <a href="../../diagnostic-builds.html" title="Cutting diagnostic builds">
+ <i class="none"></i>
+ Cutting diagnostic builds</a>
+ </li>
+
+ <li>
+
+ <a href="../../attribution.html" title="Attribution">
+ <i class="none"></i>
+ Attribution</a>
+ </li>
+ <li class="nav-header">Links</li>
+
+ <li>
+
+ <a href="http://jackrabbit.apache.org/oak" class="externalLink" title="Apache Jackrabbit Oak">
+ <i class="none"></i>
+ Apache Jackrabbit Oak</a>
+ </li>
+
+ <li>
+
+ <a href="http://jackrabbit.apache.org/" class="externalLink" title="Apache Jackrabbit">
+ <i class="none"></i>
+ Apache Jackrabbit</a>
+ </li>
+ </ul>
+
+
+
+ <hr class="divider" />
+
+ <div id="poweredBy">
+
+ <script type="text/javascript" src="https://apis.google.com/js/plusone.js"></script>
+
+
+ <div class="g-plusone" data-href="http://jackrabbit.apache.org/oak/docs/" data-size="tall" ></div>
+
+ <div class="clear"></div>
+ <div class="clear"></div>
+ <div class="clear"></div>
+ <a href="http://maven.apache.org/" title="Built by Maven" class="poweredBy">
+ <img class="builtBy" alt="Built by Maven" src="../../images/logos/maven-feather.png" />
+ </a>
+ </div>
+ </div>
+ </div>
+
+
+ <div id="bodyColumn" class="span9" >
+
+ <!-- Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements. See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License. --><div class="section">
+<h2>Restriction Management<a name="Restriction_Management"></a></h2>
+<div class="section">
+<h3>Overview<a name="Overview"></a></h3>
+<p>The concept of restriction has been created as extension to JCR access control management in order to allow for further refinement of individual policy entries.</p>
+<p>Quoting from JSR 283 section 16.6.2 Permissions:</p>
+
+<blockquote>
+<p>[…] the permissions encompass the restrictions imposed by privileges, but also include any additional policy-internal refinements with effects too fine-grained to be exposed through privilege discovery. A common case may be to provide finer-grained access restrictions to individual properties or child nodes of the node to which the policy applies.</p>
+</blockquote>
+<p>Furthermore the restriction concept is aimed to allow for custom extensions of the default access control implementation to meet project specific needs without having to implement the common functionality provided by JCR.</p>
+<p>Existing and potential examples of the restriction concept to limit the effect of a given access control entry include:</p>
+
+<ul>
+
+<li>set of node types</li>
+
+<li>set of namespaces</li>
+
+<li>name/path pattern</li>
+
+<li>dedicated time frame</li>
+
+<li>size of a value</li>
+</ul>
+<p>While few examples have been present with Jackrabbit 2.x the set of built-in restrictions has been extended as of Oak 1.0 along with some useful extensions of the Jackrabbit API. In addition Oak provides it’s own public restriction API that add support for internal validation and evaluation.</p></div>
+<div class="section">
+<h3>Jackrabbit API<a name="Jackrabbit_API"></a></h3>
+<p>The Jackrabbit API add the following extensions to JCR access control management to read and create entries with restrictions:</p>
+
+<ul>
+
+<li><tt>JackrabbitAccessControlList</tt>
+
+<ul>
+
+<li><tt>getRestrictionNames()</tt> : returns the JCR names of the supported restrictions.</li>
+
+<li><tt>getRestrictionType(String restrictionName)</tt> : returns property type of a given restriction.</li>
+
+<li><tt>addEntry(Principal, Privilege[], boolean, Map<String, Value>)</tt>: the map contain the restrictions.</li>
+
+<li><tt>addEntry(Principal, Privilege[], boolean, Map<String, Value>, Map<String, Value[]>)</tt>: allows to specify both single and multivalue restrictions (since Oak 1.0, Jackrabbit API 2.8)</li>
+ </ul></li>
+</ul>
+
+<ul>
+
+<li><tt>JackrabbitAccessControlEntry</tt>
+
+<ul>
+
+<li><tt>getRestrictionNames()</tt>: returns the JCR names of the restrictions present with this entry.</li>
+
+<li><tt>getRestriction(String restrictionName)</tt>: returns the restriction as JCR value.</li>
+
+<li><tt>getRestrictions(String restrictionName)</tt>: returns the restriction as array of JCR values (since Oak 1.0, Jackrabbit API 2.8).</li>
+ </ul></li>
+</ul>
+<p><a name="api_extensions"></a></p></div>
+<div class="section">
+<h3>Oak Restriction API<a name="Oak_Restriction_API"></a></h3>
+<p>The following public interfaces are provided by Oak in the package <tt>org.apache.jackrabbit.oak.spi.security.authorization.restriction</tt>:</p>
+
+<ul>
+
+<li><a href="/oak/docs/apidocs/org/apache/jackrabbit/oak/spi/security/authorization/restriction/RestrictionProvider.html">RestrictionProvider</a></li>
+
+<li><a href="/oak/docs/apidocs/org/apache/jackrabbit/oak/spi/security/authorization/restriction/Restriction.html">Restriction</a></li>
+
+<li><a href="/oak/docs/apidocs/org/apache/jackrabbit/oak/spi/security/authorization/restriction/RestrictionDefinition.html">RestrictionDefinition</a></li>
+
+<li><a href="/oak/docs/apidocs/org/apache/jackrabbit/oak/spi/security/authorization/restriction/RestrictionPattern.html">RestrictionPattern</a></li>
+</ul></div>
+<div class="section">
+<h3>Default Implementation<a name="Default_Implementation"></a></h3>
+<p>Oak 1.0 provides the following base implementations:</p>
+
+<ul>
+
+<li><tt>AbstractRestrictionProvider</tt>: abstract base implementation of the provider interface.</li>
+
+<li><tt>RestrictionDefinitionImpl</tt>: default implementation of the <tt>RestrictionDefinition</tt> interface.</li>
+
+<li><tt>RestrictionImpl</tt>: default implementation of the <tt>Restriction</tt> interface.</li>
+
+<li><tt>CompositeRestrictionProvider</tt>: Allows to aggregate multiple provider implementations (see <a href="#pluggability">Pluggability</a> below).</li>
+
+<li><tt>CompositePattern</tt>: Allows to aggregate multiple restriction patterns.</li>
+</ul>
+<div class="section">
+<h4>Changes wrt Jackrabbit 2.x<a name="Changes_wrt_Jackrabbit_2.x"></a></h4>
+<p>Apart from the fact that the internal Jackrabbit extension has been replaced by a public API, the restriction implementation in Oak differs from Jackrabbit 2.x as follows:</p>
+
+<ul>
+
+<li>Separate restriction management API (see below) on the OAK level that allows to ease plugging custom restrictions.</li>
+
+<li>Changed node type definition for storing restrictions in the default implementation.
+
+<ul>
+
+<li>as of OAK restrictions are collected underneath a separate child node “rep:restrictions”</li>
+
+<li>backwards compatible behavior for restrictions stored underneath the ACE node directly</li>
+ </ul></li>
+
+<li>Support for multi-valued restrictions (see <a class="externalLink" href="https://issues.apache.org/jira/browse/JCR-3637">JCR-3637</a>, <a class="externalLink" href="https://issues.apache.org/jira/browse/JCR-3641">JCR-3641</a>)</li>
+
+<li>Validation of the restrictions is delegated to a dedicated commit hook</li>
+
+<li>Restriction <tt>rep:glob</tt> limits the number of wildcard characters to 20</li>
+
+<li>New restrictions <tt>rep:ntNames</tt>, <tt>rep:prefixes</tt> and <tt>rep:itemNames</tt></li>
+</ul></div>
+<div class="section">
+<h4>Built-in Restrictions<a name="Built-in_Restrictions"></a></h4>
+<p>The default implementations of the <tt>Restriction</tt> interface are present with Oak 1.0 access control management:</p>
+
+<ul>
+
+<li><tt>rep:glob</tt>: single name, path or path pattern with ‘*’ wildcard(s).</li>
+
+<li><tt>rep:ntNames</tt>: multivalued restriction to limit the affected ACE to nodes of the specified primary node type(s) (no nt inheritence, since Oak 1.0)</li>
+
+<li><tt>rep:prefixes</tt>: multivalued restriction to limit the effect to item names that match the specified namespace prefixes (session level remapping not respected, since Oak 1.0)</li>
+
+<li><tt>rep:itemNames</tt>: multivalued restriction for property or node names (since Oak 1.3.8)</li>
+</ul>
+<div class="section">
+<h5>Examples<a name="Examples"></a></h5>
+<div class="section">
+<h6>Using rep:glob<a name="Using_rep:glob"></a></h6>
+<p>For a nodePath <tt>/foo</tt> the following results can be expected for the different values of <tt>rep:glob</tt>.</p>
+
+<table border="0" class="table table-striped">
+ <thead>
+
+<tr class="a">
+
+<th>rep:glob </th>
+
+<th>Result </th>
+ </tr>
+ </thead>
+ <tbody>
+
+<tr class="b">
+
+<td>"" </td>
+
+<td>matches node /foo only </td>
+ </tr>
+
+<tr class="a">
+
+<td>/cat </td>
+
+<td>the node /foo/cat and all it’s children </td>
+ </tr>
+
+<tr class="b">
+
+<td>/cat/ </td>
+
+<td>the descendants of the node /foo/cat </td>
+ </tr>
+
+<tr class="a">
+
+<td>cat </td>
+
+<td>the node /foocat and all it’s children </td>
+ </tr>
+
+<tr class="b">
+
+<td>cat/ </td>
+
+<td>all descendants of the node /foocat </td>
+ </tr>
+
+<tr class="a">
+
+<td>* </td>
+
+<td>foo, siblings of foo and their descendants </td>
+ </tr>
+
+<tr class="b">
+
+<td>/*cat </td>
+
+<td>all children of /foo whose path ends with ‘cat’ </td>
+ </tr>
+
+<tr class="a">
+
+<td>/*/cat </td>
+
+<td>all non-direct descendants of /foo named ‘cat’ </td>
+ </tr>
+
+<tr class="b">
+
+<td>/cat* </td>
+
+<td>all descendant path of /foo that have the direct foo-descendant segment starting with ‘cat’ </td>
+ </tr>
+
+<tr class="a">
+
+<td>*cat </td>
+
+<td>all siblings and descendants of foo that have a name ending with ‘cat’ </td>
+ </tr>
+
+<tr class="b">
+
+<td>*/cat </td>
+
+<td>all descendants of /foo and foo’s siblings that have a name segment ‘cat’ </td>
+ </tr>
+
+<tr class="a">
+
+<td>cat/* </td>
+
+<td>all descendants of ‘/foocat’ </td>
+ </tr>
+
+<tr class="b">
+
+<td>/cat/* </td>
+
+<td>all descendants of ‘/foo/cat’ </td>
+ </tr>
+
+<tr class="a">
+
+<td>*cat/* </td>
+
+<td>all descendants of /foo that have an intermediate segment ending with ‘cat’ </td>
+ </tr>
+ </tbody>
+</table></div></div></div></div>
+<div class="section">
+<h3>Representation in the Repository<a name="Representation_in_the_Repository"></a></h3>
+<p>All restrictions defined by default in a Oak repository are stored as properties in a dedicated <tt>rep:restriction</tt> child node of the target access control entry node. Similarly, they are represented with the corresponding permission entry. The node type definition used to represent restriction content is as follows:</p>
+
+<div class="source">
+<pre>[rep:ACE]
+ - rep:principalName (STRING) protected mandatory
+ - rep:privileges (NAME) protected mandatory multiple
+ - rep:nodePath (PATH) protected /* deprecated in favor of restrictions */
+ - rep:glob (STRING) protected /* deprecated in favor of restrictions */
+ - * (UNDEFINED) protected /* deprecated in favor of restrictions */
+ + rep:restrictions (rep:Restrictions) = rep:Restrictions protected /* since oak 1.0 */
+
+/**
+ * @since oak 1.0
+ */
+[rep:Restrictions]
+ - * (UNDEFINED) protected
+ - * (UNDEFINED) protected multiple
+</pre></div>
+<p><a name="pluggability"></a></p></div>
+<div class="section">
+<h3>Pluggability<a name="Pluggability"></a></h3>
+<p>The default security setup as present with Oak 1.0 is able to provide custom <tt>RestrictionProvider</tt> implementations and will automatically combine the different implementations using the <tt>CompositeRestrictionProvider</tt>.</p>
+<p>In an OSGi setup the following steps are required in order to add a action provider implementation:</p>
+
+<ul>
+
+<li>implement <tt>RestrictionProvider</tt> interface exposing your custom restriction(s).</li>
+
+<li>make the provider implementation an OSGi service and make it available to the Oak repository.</li>
+</ul>
+<div class="section">
+<div class="section">
+<h5>Examples<a name="Examples"></a></h5>
+<div class="section">
+<h6>Example RestrictionProvider<a name="Example_RestrictionProvider"></a></h6>
+<p>Simple example of a <tt>RestrictionProvider</tt> that defines a single time-based <tt>Restriction</tt>, which is expected to have 2 values defining a start and end date, which can then be used to allow or deny access within the given time frame.</p>
+
+<div class="source">
+<pre>@Component
+@Service(RestrictionProvider.class)
+public class MyRestrictionProvider extends AbstractRestrictionProvider {
+
+ public MyRestrictionProvider() {
+ super(supportedRestrictions());
+ }
+
+ private static Map<String, RestrictionDefinition> supportedRestrictions() {
+ RestrictionDefinition dates = new RestrictionDefinitionImpl("dates", Type.DATES, false);
+ return Collections.singletonMap(dates.getName(), dates);
+ }
+
+ //------------------------------------------------< RestrictionProvider >---
+
+ @Override
+ public RestrictionPattern getPattern(String oakPath, Tree tree) {
+ if (oakPath != null) {
+ PropertyState property = tree.getProperty("dates");
+ if (property != null) {
+ return DatePattern.create(property);
+ }
+ }
+ return RestrictionPattern.EMPTY;
+ }
+
+ @Nonnull
+ @Override
+ public RestrictionPattern getPattern(@Nullable String oakPath, @Nonnull Set<Restriction> restrictions) {
+ if (oakPath != null) {
+ for (Restriction r : restrictions) {
+ String name = r.getDefinition().getName();
+ if ("dates".equals(name)) {
+ return DatePattern.create(r.getProperty());
+ }
+ }
+ }
+ return RestrictionPattern.EMPTY;
+ }
+
+ // TODO: implementing 'validateRestrictions(String oakPath, Tree aceTree)' would allow to make sure the property contains 2 date values.
+}
+</pre></div></div>
+<div class="section">
+<h6>Example RestrictionPattern<a name="Example_RestrictionPattern"></a></h6>
+<p>The time-based <tt>RestrictionPattern</tt> used by the example provider above.</p>
+
+<div class="source">
+<pre>class DatePattern implements RestrictionPattern {
+
+ private final Date start;
+ private final Date end;
+
+ private DatePattern(@Nonnull Calendar start, @Nonnull Calendar end) {
+ this.start = start.getTime();
+ this.end = end.getTime();
+ }
+
+ static RestrictionPattern create(PropertyState timeProperty) {
+ if (timeProperty.count() == 2) {
+ return new DatePattern(
+ Conversions.convert(timeProperty.getValue(Type.DATE, 0), Type.DATE).toCalendar(),
+ Conversions.convert(timeProperty.getValue(Type.DATE, 1), Type.DATE).toCalendar()
+ );
+ } else {
+ return RestrictionPattern.EMPTY;
+ }
+ }
+
+ @Override
+ public boolean matches(@Nonnull Tree tree, @Nullable PropertyState property) {
+ return matches();
+ }
+
+ @Override
+ public boolean matches(@Nonnull String path) {
+ return matches();
+ }
+
+ @Override
+ public boolean matches() {
+ Date d = new Date();
+ return d.after(start) && d.before(end);
+ }
+};
+</pre></div></div>
+<div class="section">
+<h6>Example Non-OSGI Setup<a name="Example_Non-OSGI_Setup"></a></h6>
+
+<div class="source">
+<pre>RestrictionProvider rProvider = CompositeRestrictionProvider.newInstance(new MyRestrictionProvider(), ...);
+Map<String, RestrictionProvider> authorizMap = ImmutableMap.of(PARAM_RESTRICTION_PROVIDER, rProvider);
+ConfigurationParameters config = ConfigurationParameters.of(ImmutableMap.of(AuthorizationConfiguration.NAME, ConfigurationParameters.of(authorizMap)));
+SecurityProvider securityProvider = new SecurityProviderImpl(config));
+Repository repo = new Jcr(new Oak()).with(securityProvider).createRepository();
+</pre></div>
+<!-- hidden references --></div></div></div></div></div>
+ </div>
+ </div>
+ </div>
+
+ <hr/>
+
+ <footer>
+ <div class="container-fluid">
+ <div class="row span12">Copyright © 2012-2016
+ <a href="http://www.apache.org/">The Apache Software Foundation</a>.
+ All Rights Reserved.
+
+ </div>
+
+
+
+
+
+
+
+ <div id="ohloh" class="pull-right">
+ <script type="text/javascript" src="http://www.ohloh.net/p/jackrabbit-oak/widgets/project_thin_badge.js"></script>
+ </div>
+ </div>
+ </footer>
+ </body>
+</html>
\ No newline at end of file
Propchange: jackrabbit/site/live/oak/docs/security/authorization/restriction.html
------------------------------------------------------------------------------
svn:eol-style = native
Added: jackrabbit/site/live/oak/docs/security/introduction.html
URL: http://svn.apache.org/viewvc/jackrabbit/site/live/oak/docs/security/introduction.html?rev=1730074&view=auto
==============================================================================
--- jackrabbit/site/live/oak/docs/security/introduction.html (added)
+++ jackrabbit/site/live/oak/docs/security/introduction.html Fri Feb 12 17:09:05 2016
@@ -0,0 +1,627 @@
+<!DOCTYPE html>
+<!--
+ | Generated by Apache Maven Doxia at 2016-02-12
+ | Rendered using Apache Maven Fluido Skin 1.3.0
+-->
+<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
+ <head>
+ <meta charset="UTF-8" />
+ <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+ <meta name="Date-Revision-yyyymmdd" content="20160212" />
+ <meta http-equiv="Content-Language" content="en" />
+ <title>Jackrabbit Oak - Introduction to Oak Security</title>
+ <link rel="stylesheet" href="../css/apache-maven-fluido-1.3.0.min.css" />
+ <link rel="stylesheet" href="../css/site.css" />
+ <link rel="stylesheet" href="../css/print.css" media="print" />
+
+
+ <script type="text/javascript" src="../js/apache-maven-fluido-1.3.0.min.js"></script>
+
+
+ </head>
+ <body class="topBarEnabled">
+
+
+
+
+
+
+ <a href="http://github.com/apache/jackrabbit-oak">
+ <img style="position: absolute; top: 0; right: 0; border: 0; z-index: 10000;"
+ src="https://s3.amazonaws.com/github/ribbons/forkme_right_red_aa0000.png"
+ alt="Fork me on GitHub">
+ </a>
+
+
+
+
+
+ <div id="topbar" class="navbar navbar-fixed-top ">
+ <div class="navbar-inner">
+ <div class="container-fluid">
+ <a data-target=".nav-collapse" data-toggle="collapse" class="btn btn-navbar">
+ <span class="icon-bar"></span>
+ <span class="icon-bar"></span>
+ <span class="icon-bar"></span>
+ </a>
+
+ <a class="brand" href="../" title="Oak logo">
+
+
+ <img src="../oak_logo.png" alt="Oak logo" />
+
+ </a>
+
+ <ul class="nav">
+ <li class="dropdown">
+ <a href="#" class="dropdown-toggle" data-toggle="dropdown">Overview <b class="caret"></b></a>
+ <ul class="dropdown-menu">
+
+ <li> <a href="../index.html" title="Jackrabbit Oak">Jackrabbit Oak</a>
+</li>
+
+ <li> <a href="../license.html" title="License">License</a>
+</li>
+
+ <li> <a href="../downloads.html" title="Downloads">Downloads</a>
+</li>
+ </ul>
+ </li>
+ <li class="dropdown">
+ <a href="#" class="dropdown-toggle" data-toggle="dropdown">Concepts and Architecture <b class="caret"></b></a>
+ <ul class="dropdown-menu">
+
+ <li> <a href="../architecture/overview.html" title="Overview">Overview</a>
+</li>
+
+ <li> <a href="../architecture/nodestate.html" title="The Node State Model">The Node State Model</a>
+</li>
+ </ul>
+ </li>
+ <li class="dropdown">
+ <a href="#" class="dropdown-toggle" data-toggle="dropdown">Main APIs <b class="caret"></b></a>
+ <ul class="dropdown-menu">
+
+ <li> <a href="http://www.day.com/specs/jcr/2.0/index.html" title="JCR API">JCR API</a>
+</li>
+
+ <li> <a href="../oak_api/overview.html" title="Oak API">Oak API</a>
+</li>
+ </ul>
+ </li>
+ <li class="dropdown">
+ <a href="#" class="dropdown-toggle" data-toggle="dropdown">Features and Plugins <b class="caret"></b></a>
+ <ul class="dropdown-menu">
+
+ <li> <a href="../features/atomic-counter.html" title="Atomic Counter">Atomic Counter</a>
+</li>
+
+ <li> <a href="../plugins/blobstore.html" title="Blob Storage">Blob Storage</a>
+</li>
+
+ <li> <a href="../clustering.html" title="Clustering">Clustering</a>
+</li>
+
+ <li> <a href="../nodestore/documentmk.html" title="DocumentNodeStore">DocumentNodeStore</a>
+</li>
+
+ <li> <a href="../nodestore/overview.html" title="Node Storage">Node Storage</a>
+</li>
+
+ <li> <a href="../nodestore/persistent-cache.html" title="Persistent Cache">Persistent Cache</a>
+</li>
+
+ <li> <a href="../query/query.html" title="Query">Query</a>
+</li>
+
+ <li> <a href="../security/overview.html" title="Security">Security</a>
+</li>
+
+ <li> <a href="../nodestore/segment/overview.html" title="Segment Node Store">Segment Node Store</a>
+</li>
+ </ul>
+ </li>
+ <li class="dropdown">
+ <a href="#" class="dropdown-toggle" data-toggle="dropdown">Using Oak <b class="caret"></b></a>
+ <ul class="dropdown-menu">
+
+ <li> <a href="../use_getting_started.html" title="Getting Started">Getting Started</a>
+</li>
+
+ <li> <a href="../construct.html" title="Repository Construction">Repository Construction</a>
+</li>
+
+ <li> <a href="../osgi_config.html" title="Configuring Oak">Configuring Oak</a>
+</li>
+
+ <li> <a href="../command_line.html" title="Command Line Tools">Command Line Tools</a>
+</li>
+
+ <li> <a href="../migration.html" title="Migration">Migration</a>
+</li>
+
+ <li> <a href="../differences.html" title="Differences to Jackrabbit 2">Differences to Jackrabbit 2</a>
+</li>
+
+ <li> <a href="../known_issues.html" title="Known Issues">Known Issues</a>
+</li>
+
+ <li> <a href="../dos_and_donts.html" title="Dos and Don'ts">Dos and Don'ts</a>
+</li>
+
+ <li> <a href="../coldstandby/coldstandby.html" title="Cold Standby">Cold Standby</a>
+</li>
+
+ <li> <a href="../FAQ.html" title="FAQ">FAQ</a>
+</li>
+ </ul>
+ </li>
+ <li class="dropdown">
+ <a href="#" class="dropdown-toggle" data-toggle="dropdown">Developing Oak <b class="caret"></b></a>
+ <ul class="dropdown-menu">
+
+ <li> <a href="../dev_getting_started.html" title="Getting Started">Getting Started</a>
+</li>
+
+ <li> <a href="../participating.html" title="Participating">Participating</a>
+</li>
+
+ <li> <a href="../developing-with-git.html" title="Developing with Git">Developing with Git</a>
+</li>
+
+ <li> <a href="../diagnostic-builds.html" title="Cutting diagnostic builds">Cutting diagnostic builds</a>
+</li>
+
+ <li> <a href="../attribution.html" title="Attribution">Attribution</a>
+</li>
+ </ul>
+ </li>
+ <li class="dropdown">
+ <a href="#" class="dropdown-toggle" data-toggle="dropdown">Links <b class="caret"></b></a>
+ <ul class="dropdown-menu">
+
+ <li> <a href="http://jackrabbit.apache.org/oak" title="Apache Jackrabbit Oak">Apache Jackrabbit Oak</a>
+</li>
+
+ <li> <a href="http://jackrabbit.apache.org/" title="Apache Jackrabbit">Apache Jackrabbit</a>
+</li>
+ </ul>
+ </li>
+ </ul>
+
+
+
+
+ </div>
+
+ </div>
+ </div>
+ </div>
+
+ <div class="container-fluid">
+ <div id="banner">
+ <div class="pull-left">
+ <div id="bannerLeft">
+ <h2>Oak Documentation</h2>
+ </div>
+ </div>
+ <div class="pull-right"> </div>
+ <div class="clear"><hr/></div>
+ </div>
+
+ <div id="breadcrumbs">
+ <ul class="breadcrumb">
+
+
+ <li id="publishDate">Last Published: 2016-02-12</li>
+ <li class="divider">|</li> <li id="projectVersion">Version: 1.4-SNAPSHOT</li>
+
+
+
+
+ </ul>
+ </div>
+
+
+ <div class="row-fluid">
+ <div id="leftColumn" class="span3">
+ <div class="well sidebar-nav">
+
+
+ <ul class="nav nav-list">
+ <li class="nav-header">Overview</li>
+
+ <li>
+
+ <a href="../index.html" title="Jackrabbit Oak">
+ <i class="none"></i>
+ Jackrabbit Oak</a>
+ </li>
+
+ <li>
+
+ <a href="../license.html" title="License">
+ <i class="none"></i>
+ License</a>
+ </li>
+
+ <li>
+
+ <a href="../downloads.html" title="Downloads">
+ <i class="none"></i>
+ Downloads</a>
+ </li>
+ <li class="nav-header">Concepts and Architecture</li>
+
+ <li>
+
+ <a href="../architecture/overview.html" title="Overview">
+ <i class="none"></i>
+ Overview</a>
+ </li>
+
+ <li>
+
+ <a href="../architecture/nodestate.html" title="The Node State Model">
+ <i class="none"></i>
+ The Node State Model</a>
+ </li>
+ <li class="nav-header">Main APIs</li>
+
+ <li>
+
+ <a href="http://www.day.com/specs/jcr/2.0/index.html" class="externalLink" title="JCR API">
+ <i class="none"></i>
+ JCR API</a>
+ </li>
+
+ <li>
+
+ <a href="../oak_api/overview.html" title="Oak API">
+ <i class="none"></i>
+ Oak API</a>
+ </li>
+ <li class="nav-header">Features and Plugins</li>
+
+ <li>
+
+ <a href="../features/atomic-counter.html" title="Atomic Counter">
+ <i class="none"></i>
+ Atomic Counter</a>
+ </li>
+
+ <li>
+
+ <a href="../plugins/blobstore.html" title="Blob Storage">
+ <i class="none"></i>
+ Blob Storage</a>
+ </li>
+
+ <li>
+
+ <a href="../clustering.html" title="Clustering">
+ <i class="none"></i>
+ Clustering</a>
+ </li>
+
+ <li>
+
+ <a href="../nodestore/documentmk.html" title="DocumentNodeStore">
+ <i class="none"></i>
+ DocumentNodeStore</a>
+ </li>
+
+ <li>
+
+ <a href="../nodestore/overview.html" title="Node Storage">
+ <i class="none"></i>
+ Node Storage</a>
+ </li>
+
+ <li>
+
+ <a href="../nodestore/persistent-cache.html" title="Persistent Cache">
+ <i class="none"></i>
+ Persistent Cache</a>
+ </li>
+
+ <li>
+
+ <a href="../query/query.html" title="Query">
+ <i class="none"></i>
+ Query</a>
+ </li>
+
+ <li>
+
+ <a href="../security/overview.html" title="Security">
+ <i class="none"></i>
+ Security</a>
+ </li>
+
+ <li>
+
+ <a href="../nodestore/segment/overview.html" title="Segment Node Store">
+ <i class="none"></i>
+ Segment Node Store</a>
+ </li>
+ <li class="nav-header">Using Oak</li>
+
+ <li>
+
+ <a href="../use_getting_started.html" title="Getting Started">
+ <i class="none"></i>
+ Getting Started</a>
+ </li>
+
+ <li>
+
+ <a href="../construct.html" title="Repository Construction">
+ <i class="none"></i>
+ Repository Construction</a>
+ </li>
+
+ <li>
+
+ <a href="../osgi_config.html" title="Configuring Oak">
+ <i class="none"></i>
+ Configuring Oak</a>
+ </li>
+
+ <li>
+
+ <a href="../command_line.html" title="Command Line Tools">
+ <i class="none"></i>
+ Command Line Tools</a>
+ </li>
+
+ <li>
+
+ <a href="../migration.html" title="Migration">
+ <i class="none"></i>
+ Migration</a>
+ </li>
+
+ <li>
+
+ <a href="../differences.html" title="Differences to Jackrabbit 2">
+ <i class="none"></i>
+ Differences to Jackrabbit 2</a>
+ </li>
+
+ <li>
+
+ <a href="../known_issues.html" title="Known Issues">
+ <i class="none"></i>
+ Known Issues</a>
+ </li>
+
+ <li>
+
+ <a href="../dos_and_donts.html" title="Dos and Don'ts">
+ <i class="none"></i>
+ Dos and Don'ts</a>
+ </li>
+
+ <li>
+
+ <a href="../coldstandby/coldstandby.html" title="Cold Standby">
+ <i class="none"></i>
+ Cold Standby</a>
+ </li>
+
+ <li>
+
+ <a href="../FAQ.html" title="FAQ">
+ <i class="none"></i>
+ FAQ</a>
+ </li>
+ <li class="nav-header">Developing Oak</li>
+
+ <li>
+
+ <a href="../dev_getting_started.html" title="Getting Started">
+ <i class="none"></i>
+ Getting Started</a>
+ </li>
+
+ <li>
+
+ <a href="../participating.html" title="Participating">
+ <i class="none"></i>
+ Participating</a>
+ </li>
+
+ <li>
+
+ <a href="../developing-with-git.html" title="Developing with Git">
+ <i class="none"></i>
+ Developing with Git</a>
+ </li>
+
+ <li>
+
+ <a href="../diagnostic-builds.html" title="Cutting diagnostic builds">
+ <i class="none"></i>
+ Cutting diagnostic builds</a>
+ </li>
+
+ <li>
+
+ <a href="../attribution.html" title="Attribution">
+ <i class="none"></i>
+ Attribution</a>
+ </li>
+ <li class="nav-header">Links</li>
+
+ <li>
+
+ <a href="http://jackrabbit.apache.org/oak" class="externalLink" title="Apache Jackrabbit Oak">
+ <i class="none"></i>
+ Apache Jackrabbit Oak</a>
+ </li>
+
+ <li>
+
+ <a href="http://jackrabbit.apache.org/" class="externalLink" title="Apache Jackrabbit">
+ <i class="none"></i>
+ Apache Jackrabbit</a>
+ </li>
+ </ul>
+
+
+
+ <hr class="divider" />
+
+ <div id="poweredBy">
+
+ <script type="text/javascript" src="https://apis.google.com/js/plusone.js"></script>
+
+
+ <div class="g-plusone" data-href="http://jackrabbit.apache.org/oak/docs/" data-size="tall" ></div>
+
+ <div class="clear"></div>
+ <div class="clear"></div>
+ <div class="clear"></div>
+ <a href="http://maven.apache.org/" title="Built by Maven" class="poweredBy">
+ <img class="builtBy" alt="Built by Maven" src="../images/logos/maven-feather.png" />
+ </a>
+ </div>
+ </div>
+ </div>
+
+
+ <div id="bodyColumn" class="span9" >
+
+ <!-- Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements. See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License. --><div class="section">
+<h2>Introduction to Oak Security<a name="Introduction_to_Oak_Security"></a></h2>
+<div class="section">
+<h3>General<a name="General"></a></h3>
+<p>The main entry point to Oak security is the <tt>SecurityProvider</tt>, which is registered to the Oak repository upon creation. The provider is in charge of collecting and exposing all security related modules present in a given Oak repository. </p>
+<p>Each security module comes with one or multiple <tt>SecurityConfiguration</tt>(s) that is registered with the provider, identified (and possibly aggregated) by their name.</p></div>
+<div class="section">
+<h3>Modules<a name="Modules"></a></h3>
+<p>Currently Oak comes with the following built-in security modules, each defined by a dedicated sub-interfaces of <a href="/oak/docs/apidocs/org/apache/jackrabbit/oak/spi/security/SecurityConfiguration.html">SecurityConfiguration</a>:</p>
+
+<ul>
+
+<li>Authentication
+
+<ul>
+
+<li>Authentication s.str.</li>
+
+<li>Token Authentication and Token Management</li>
+ </ul></li>
+
+<li>Authorization
+
+<ul>
+
+<li>Authorization s.str.</li>
+
+<li>Privilege Management</li>
+ </ul></li>
+
+<li>Principal Management</li>
+
+<li>User Management</li>
+</ul>
+<p><a name="api_extensions"></a></p></div>
+<div class="section">
+<h3>API Extensions<a name="API_Extensions"></a></h3>
+<p>The package <tt>org.apache.jackrabbit.oak.spi.security</tt> defines the following interfaces and base implementations:</p>
+
+<ul>
+
+<li><a href="/oak/docs/apidocs/org/apache/jackrabbit/oak/spi/security/SecurityProvider.html">SecurityProvider</a>: Main entry point for Oak security.
+
+<ul>
+
+<li><a href="/oak/docs/apidocs/org/apache/jackrabbit/oak/spi/security/OpenSecurityProvider.html">OpenSecurityProvider</a>: Rudimentary implementation for test purpose.</li>
+ </ul></li>
+
+<li><a href="/oak/docs/apidocs/org/apache/jackrabbit/oak/spi/security/SecurityConfiguration.html">SecurityConfiguration</a>: Base interface for all security related configurations.
+
+<ul>
+
+<li><a href="/oak/docs/apidocs/org/apache/jackrabbit/oak/spi/security/ConfigurationBase.html">ConfigurationBase</a>: Abstract base implementation of the <tt>SecurityConfiguration</tt> interface.</li>
+
+<li><a href="/oak/docs/apidocs/org/apache/jackrabbit/oak/spi/security/CompositeConfiguration.html">CompositeConfiguration</a>: Abstract base implementation for all composite configurations that allow for aggregation of multiple modules.</li>
+ </ul></li>
+
+<li><a href="/oak/docs/apidocs/org/apache/jackrabbit/oak/spi/security/ConfigurationParameters.html">ConfigurationParameters</a>: Utility used to pass around parameters and options.</li>
+
+<li><a href="/oak/docs/apidocs/org/apache/jackrabbit/oak/spi/security/Context.html">Context</a>: Context information associated with a given <tt>SecurityConfiguration</tt> that allow to identify items defined and maintained by a give security module implementation.</li>
+</ul>
+<div class="section">
+<h4>SecurityProvider<a name="SecurityProvider"></a></h4>
+<p><i>TODO</i></p></div>
+<div class="section">
+<h4>SecurityConfiguration<a name="SecurityConfiguration"></a></h4>
+<p><i>TODO</i></p>
+
+<ul>
+
+<li><a href="/oak/docs/apidocs/org/apache/jackrabbit/oak/spi/security/authentication/AuthenticationConfiguration.html">AuthenticationConfiguration</a></li>
+
+<li><a href="/oak/docs/apidocs/org/apache/jackrabbit/oak/spi/security/authentication/token/TokenConfiguration.html">TokenConfiguration</a> : multiple</li>
+
+<li><a href="/oak/docs/apidocs/org/apache/jackrabbit/oak/spi/security/authorization/AuthorizationConfiguration.html">AuthorizationConfiguration</a> : multiple since Oak 1.4</li>
+
+<li><a href="/oak/docs/apidocs/org/apache/jackrabbit/oak/spi/security/privilege/PrivilegeConfiguration.html">PrivilegeConfiguration</a></li>
+
+<li><a href="/oak/docs/apidocs/org/apache/jackrabbit/oak/spi/security/principal/PrincipalConfiguration.html">PrincipalConfiguration</a>, multiple</li>
+
+<li><a href="/oak/docs/apidocs/org/apache/jackrabbit/oak/spi/security/user/UserConfiguration.html">UserConfiguration</a></li>
+</ul>
+<p><i>TODO</i></p>
+<p><a name="configuration"></a></p></div></div>
+<div class="section">
+<h3>Configuration<a name="Configuration"></a></h3>
+<p><i>TODO</i></p>
+<p><a name="pluggability"></a></p></div>
+<div class="section">
+<h3>Pluggability<a name="Pluggability"></a></h3>
+<p><i>TODO</i></p>
+<!-- references --></div></div>
+ </div>
+ </div>
+ </div>
+
+ <hr/>
+
+ <footer>
+ <div class="container-fluid">
+ <div class="row span12">Copyright © 2012-2016
+ <a href="http://www.apache.org/">The Apache Software Foundation</a>.
+ All Rights Reserved.
+
+ </div>
+
+
+
+
+
+
+
+ <div id="ohloh" class="pull-right">
+ <script type="text/javascript" src="http://www.ohloh.net/p/jackrabbit-oak/widgets/project_thin_badge.js"></script>
+ </div>
+ </div>
+ </footer>
+ </body>
+</html>
\ No newline at end of file
Propchange: jackrabbit/site/live/oak/docs/security/introduction.html
------------------------------------------------------------------------------
svn:eol-style = native
Modified: jackrabbit/site/live/oak/docs/security/overview.html
URL: http://svn.apache.org/viewvc/jackrabbit/site/live/oak/docs/security/overview.html?rev=1730074&r1=1730073&r2=1730074&view=diff
==============================================================================
--- jackrabbit/site/live/oak/docs/security/overview.html (original)
+++ jackrabbit/site/live/oak/docs/security/overview.html Fri Feb 12 17:09:05 2016
@@ -1,13 +1,13 @@
<!DOCTYPE html>
<!--
- | Generated by Apache Maven Doxia at 2016-02-08
+ | Generated by Apache Maven Doxia at 2016-02-10
| Rendered using Apache Maven Fluido Skin 1.3.0
-->
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
- <meta name="Date-Revision-yyyymmdd" content="20160208" />
+ <meta name="Date-Revision-yyyymmdd" content="20160210" />
<meta http-equiv="Content-Language" content="en" />
<title>Jackrabbit Oak - The Oak Security Layer</title>
<link rel="stylesheet" href="../css/apache-maven-fluido-1.3.0.min.css" />
@@ -213,7 +213,7 @@
<ul class="breadcrumb">
- <li id="publishDate">Last Published: 2016-02-08</li>
+ <li id="publishDate">Last Published: 2016-02-10</li>
<li class="divider">|</li> <li id="projectVersion">Version: 1.4-SNAPSHOT</li>
@@ -507,6 +507,13 @@
limitations under the License. --><div class="section">
<h2>The Oak Security Layer<a name="The_Oak_Security_Layer"></a></h2>
<div class="section">
+<h3>General<a name="General"></a></h3>
+
+<ul>
+
+<li><a href="introduction.html">Introduction to Oak Security</a></li>
+</ul></div>
+<div class="section">
<h3>Authentication<a name="Authentication"></a></h3>
<ul>
@@ -515,20 +522,32 @@
<li><a href="authentication/differences.html">Differences wrt Jackrabbit 2.x</a></li>
+<li><a href="authentication/default.html">Authentication : Implementation Details</a></li>
+
<li><a href="authentication/tokenmanagement.html">Token Authentication and Token Management</a></li>
-<li><a href="authentication/externalloginmodule.html">External Authentication</a></li>
+<li><a href="authentication/externalloginmodule.html">External Authentication</a>
+<ul>
+
<li><a href="authentication/usersync.html">User and Group Synchronization</a></li>
-
+
<li><a href="authentication/identitymanagement.html">Identity Management</a></li>
-
+
<li><a href="authentication/ldap.html">LDAP Integration</a></li>
+ </ul></li>
<li><a href="authentication/preauthentication.html">Pre-Authentication</a></li>
</ul></div>
<div class="section">
-<h3>Access Control<a name="Access_Control"></a></h3>
+<h3>Authorization<a name="Authorization"></a></h3>
+
+<ul>
+
+<li><a href="authorization.html">Overview</a></li>
+</ul>
+<div class="section">
+<h4>Access Control Management<a name="Access_Control_Management"></a></h4>
<ul>
@@ -536,12 +555,14 @@
<li><a href="accesscontrol/differences.html">Differences wrt Jackrabbit 2.x</a></li>
-<li><a href="accesscontrol/restriction.html">Restriction Management</a></li>
+<li><a href="accesscontrol/default.html">Access Control Management : The Default Implementation</a></li>
+
+<li><a href="authorization/restriction.html">Restriction Management</a></li>
<li><a href="accesscontrol/editing.html">Using the API</a></li>
</ul></div>
<div class="section">
-<h3>Permissions<a name="Permissions"></a></h3>
+<h4>Permissions<a name="Permissions"></a></h4>
<ul>
@@ -549,18 +570,39 @@
<li><a href="permission/differences.html">Differences wrt Jackrabbit 2.x</a></li>
-<li><a href="permission/evaluation.html">Permission Evaluation in Detail</a></li>
+<li><a href="permission/default.html">Permissions : The Default Implementation</a>
+
+<ul>
+
+<li><a href="permission/evaluation.html">Permission Evaluation in Detail : The Default Implementation</a></li>
+ </ul></li>
</ul></div>
<div class="section">
-<h3>Privilege Management<a name="Privilege_Management"></a></h3>
+<h4>Privilege Management<a name="Privilege_Management"></a></h4>
<ul>
<li><a href="privilege.html">Overview</a></li>
<li><a href="privilege/differences.html">Differences wrt Jackrabbit 2.x</a></li>
+
+<li>Mapping Privileges to Items and API Calls
+
+<ul>
+
+<li><a href="privilege/mappingtoitems.html">Mapping Privileges to Items</a></li>
+
+<li><a href="privilege/mappingtoprivileges.html">Mapping API Calls to Privileges</a></li>
+ </ul></li>
</ul></div>
<div class="section">
+<h4>Extensions<a name="Extensions"></a></h4>
+
+<ul>
+
+<li><a href="authorization/cug.html">Managing Access with Closed User Groups (CUG)</a></li>
+</ul></div></div>
+<div class="section">
<h3>Principal Management<a name="Principal_Management"></a></h3>
<ul>
@@ -578,15 +620,22 @@
<li><a href="user/differences.html">Differences wrt Jackrabbit 2.x</a></li>
-<li><a href="user/membership.html">Group Membership</a></li>
+<li><a href="user/default.html">User Management : The Default Implementation</a>
+<ul>
+
+<li><a href="user/membership.html">Group Membership</a></li>
+
+<li><a href="user/query.html">Searching Users and Groups</a></li>
+
<li><a href="user/authorizableaction.html">Authorizable Actions</a></li>
-
+
<li><a href="user/authorizablenodename.html">Authorizable Node Name Generation</a></li>
-
-<li><a href="user/query.html">Searching Users and Groups</a></li>
-
+
<li><a href="user/expiry.html">Password Expiry and Force Initial Password Change</a></li>
+
+<li><a href="user/history.html">Password History</a></li>
+ </ul></li>
</ul></div></div>
</div>
</div>
Modified: jackrabbit/site/live/oak/docs/security/permission.html
URL: http://svn.apache.org/viewvc/jackrabbit/site/live/oak/docs/security/permission.html?rev=1730074&r1=1730073&r2=1730074&view=diff
==============================================================================
--- jackrabbit/site/live/oak/docs/security/permission.html (original)
+++ jackrabbit/site/live/oak/docs/security/permission.html Fri Feb 12 17:09:05 2016
@@ -1,13 +1,13 @@
<!DOCTYPE html>
<!--
- | Generated by Apache Maven Doxia at 2016-02-08
+ | Generated by Apache Maven Doxia at 2016-02-12
| Rendered using Apache Maven Fluido Skin 1.3.0
-->
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
- <meta name="Date-Revision-yyyymmdd" content="20160208" />
+ <meta name="Date-Revision-yyyymmdd" content="20160212" />
<meta http-equiv="Content-Language" content="en" />
<title>Jackrabbit Oak - Permissions</title>
<link rel="stylesheet" href="../css/apache-maven-fluido-1.3.0.min.css" />
@@ -213,7 +213,7 @@
<ul class="breadcrumb">
- <li id="publishDate">Last Published: 2016-02-08</li>
+ <li id="publishDate">Last Published: 2016-02-12</li>
<li class="divider">|</li> <li id="projectVersion">Version: 1.4-SNAPSHOT</li>
@@ -508,6 +508,7 @@
See the License for the specific language governing permissions and
limitations under the License. --><div class="section">
<h2>Permissions<a name="Permissions"></a></h2>
+<p><a href="jcr_api"></a></p>
<div class="section">
<h3>JCR API<a name="JCR_API"></a></h3>
<p>While access control management is a optional feature, a JCR implementation is required to support the basic permission checking. The basic requirements for the permission evalution are defines as follows</p>
@@ -559,7 +560,8 @@ if (session.hasPermission("/content
content.checkin();
session.save();
}
-</pre></div></div></div></div></div>
+</pre></div>
+<p><a href="oak_permissions"></a></p></div></div></div></div>
<div class="section">
<h3>Oak Permissions<a name="Oak_Permissions"></a></h3>
<div class="section">
@@ -741,161 +743,12 @@ if (session.hasPermission("/content
<li><b>Versioning</b>: Executing version related operations and thus writing to the version store requires <tt>VERSION_MANAGEMENT</tt> permission instead of the regular JCR write permissions. Similarly, the content in the version store can only be modified using the dedicated version management API.</li>
<li><b>User Management</b>: By default user management operations require the specific user management related permission <tt>USER_MANAGEMENT</tt> to be granted for the editing subject. This permission (including a corresponding privilege) has been introduced with Oak 1.0. See below for configuration parameters to obtain backwards compatible behavior.</li>
-</ul></div></div></div>
-<div class="section">
-<h3>Characteristics of the Permission Evaluation<a name="Characteristics_of_the_Permission_Evaluation"></a></h3>
-<div class="section">
-<h4>General Notes<a name="General_Notes"></a></h4>
-<p>As explained above permission evaluation is completely separated from the access control management and the associated ccontent. The evaluation itself is done by the configured <tt>PermissionProvider</tt>.</p>
-<p>The default implementation of the <tt>PermissionProvider</tt> interface evaluates permissions based on the information stored in a dedicated part of the repository content call the <a href="#permissionStore">permission store</a>.</p>
-<p>Similar each JCR <tt>Session</tt> (and Oak <tt>ContentSession</tt>) gets it’s own <tt>PermissionProvider</tt> associated with the current repository revision the session is operating on. The evaluated permissions and caches are not shared between different sessions even if they represent the same subject.</p></div>
-<div class="section">
-<h4>Differences wrt Jackrabbit 2.x<a name="Differences_wrt_Jackrabbit_2.x"></a></h4>
-<p>see the corresponding <a href="permission/differences.html">documentation</a>.</p></div>
-<div class="section">
-<h4>Details on Permission Evaluation<a name="Details_on_Permission_Evaluation"></a></h4>
-<div class="section">
-<h5>Administrative Access<a name="Administrative_Access"></a></h5>
-<p>In the default implementation following principals always have full access to the whole content repository (except for hidden items that are not exposed on the Oak API) irrespective of the access control content:</p>
-
-<ul>
-
-<li><tt>SystemPrincipal</tt></li>
-
-<li>All instances of <tt>AdminPrincipal</tt></li>
-
-<li>All principals whose name matches the configured administrative principal names (see Configuration section below). This configuration only applies to the permission evaluation and is currently not reflected in other security models nor methods that deal with the administrator (i.e. <tt>User#isAdmin</tt>).</li>
-</ul></div>
-<div class="section">
-<h5>Readable Trees<a name="Readable_Trees"></a></h5>
-<p>Oak 1.0 comes with a configurable set of subtrees that are read-accessible to all subjects irrespective of other access control content taking effect. The original aim of these readable trees is to assert full acccess to namespace, nodetype and privilege information and the corresponding configuration therefore lists the following paths:</p>
-
-<ul>
-
-<li><tt>/jcr:system/rep:namespaces</tt>: stores all registered namespaces</li>
-
-<li><tt>/jcr:system/jcr:nodeTypes</tt>: stores all registered node types</li>
-
-<li><tt>/jcr:system/rep:privileges</tt>: stores all registered privileges</li>
</ul>
-<p>This default set can be changed or extended by setting the corresponding configuration option. However, it is important to note that many JCR API calls rely on the accessibility of the namespace, nodetype and privilege information. Removing the corresponding paths from the configuration will most probably have undesired effects.</p></div>
-<div class="section">
-<h5>Regular Permission Evaluation<a name="Regular_Permission_Evaluation"></a></h5>
-<p>See section <a href="permission/evaluation.html">Permission Evaluation in Detail</a>.</p></div></div>
-<div class="section">
-<h4>Permission Representation in the Repository<a name="Permission_Representation_in_the_Repository"></a></h4>
-<p><a name="permissionStore"></a></p>
-<div class="section">
-<h5>Permission Store<a name="Permission_Store"></a></h5>
-<p>The permission evaluation present with Oak 1.0 keeps a dedicated location where permissions are being stored for later evaluation. The store is kept in sync with the access control content by a separated <tt>PostValidationHook</tt> implementation (<a href="/oak/docs/apidocs/org/apache/jackrabbit/oak/security/authorization/permission/PermissionHook.html">PermissionHook</a>).</p>
-<p>The location of the permission store is <tt>/jcr:system/rep:permissionStore</tt>; in accordance with other stores underneath <tt>jcr:system</tt> it is global to the whole repository keeping a separate entry for each workspace present with the repository.</p>
-<p>The permission entries are grouped by principal and stored below the store root based on the hash value of the path of the access controlled node; hash collisions are handled by adding subnodes accordingly.</p>
-
-<div class="source">
-<pre>/jcr:system/rep:permissionStore/workspace-name [rep:PermissionStore]
- /principal-name [rep:PermissionStore]
- /1259237738 [rep:PermissionStore]
- /0 [rep:Permissions]
- /1 [rep:Permissions]
- /c0 [rep:PermissionStore] # hash collision
- /0 [rep:Permissions]
- /1 [rep:Permissions]
- /2 [rep:Permissions]
- /c1 [rep:PermissionStore] # hash collision
- /0 [rep:Permissions]
- /1 [rep:Permissions]
- /2 [rep:Permissions]
- /47 [rep:PermissionStore]
- /0 [rep:Permissions]
- /1 [rep:Permissions]
-</pre></div>
-<p>Each per path store looks as follows</p>
-
-<div class="source">
-<pre>"1259237738" {
- "jcr:primaryType": "rep:PermissionStore",
- "rep:accessControlledPath": "/content",
- "0": {
- "jcr:primaryType": "rep:Permissions",
- "rep:isAllow": false,
- "rep:privileges": [32],
- "rep:ntNames": ["nt:unstructured", "oak:Unstructured"]
- ... /* additional restrictions as present in the entry */
- }
-}
-</pre></div>
-<div class="section">
-<h6>Accessing the Permission Store<a name="Accessing_the_Permission_Store"></a></h6>
-<p>It is important to understand that the permission store is a implementation specific structure that is maintained by the system itself. For this reason access to the permission store is additionally restricted superimposing the regular permissions being enforced for regular repository items.</p>
-<p>In detail this means that the permission store cannot be written by JCR nor Oak API method calls. It’s immutability is enforced by a dedicated <tt>FailingValidator</tt> that prevents any modifications underneath <tt>/jcr:system/rep:permissionStore</tt>. Similarly read access is not allowed except for system principals. In order to discover and display access control related information API consumers should use the regular JCR and Jackrabbit permission and access control management API as listed above and in section <a href="accesscontrol/editing.html">Using the Access Control Management API</a>.</p></div></div>
-<div class="section">
-<h5>Node Type Definitions<a name="Node_Type_Definitions"></a></h5>
-<p>For the permission store the following built-in node types have been defined:</p>
-
-<div class="source">
-<pre>[rep:PermissionStore]
- - rep:accessControlledPath (STRING) protected IGNORE
- - rep:numPermissions (LONG) protected IGNORE
- - rep:modCount (LONG) protected IGNORE
- + * (rep:PermissionStore) = rep:PermissionStore protected IGNORE
- + * (rep:Permissions) = rep:Permissions protected IGNORE
-
-[rep:Permissions]
- - * (UNDEFINED) protected IGNORE
- - * (UNDEFINED) protected multiple IGNORE
- + * (rep:Permissions) = rep:Permissions protected IGNORE
-</pre></div>
-<p>In addition Oak 1.0 defines a specific mixin type that allows to store the path(s) of the versionable node with each version history. Adding this mixing and updating the versionable path information is taken care of by a dedicated commit hook implementation (<tt>VersionablePathHook</tt>).</p>
-
-<div class="source">
-<pre>[rep:VersionablePaths]
- mixin
- - * (PATH) protected ABORT
-</pre></div>
-<p><a name="validation"></a></p></div>
-<div class="section">
-<h5>Validation<a name="Validation"></a></h5>
-<p>The consistency of this content structure is asserted by a dedicated <tt>PermissionValidator</tt>. The corresponding errors are all of type <tt>Access</tt> with the following codes:</p>
-
-<table border="0" class="table table-striped">
- <thead>
-
-<tr class="a">
-
-<th>Code </th>
-
-<th>Message </th>
- </tr>
- </thead>
- <tbody>
-
-<tr class="b">
-
-<td>0000 </td>
-
-<td>Generic access violation </td>
- </tr>
-
-<tr class="a">
-
-<td>0021 </td>
-
-<td>Version storage: Node creation without version history </td>
- </tr>
-
-<tr class="b">
-
-<td>0022 </td>
-
-<td>Version storage: Removal of intermediate node </td>
- </tr>
- </tbody>
-</table>
<p><a name="api_extensions"></a></p></div></div></div>
<div class="section">
<h3>API Extensions<a name="API_Extensions"></a></h3>
<p>Due to the separation of access control management from permission evaluation, Oak 1.0 comes with a dedicated API for permission discovery that is used both for the repository internal permission evaluation as well as for permission discovery at JCR level.</p>
-<p>The package <tt>org.apache.jackrabbit.oak.spi.security.authorization.permission</tt> defines the following interface:</p>
+<p>The package <tt>org.apache.jackrabbit.oak.spi.security.authorization.permission</tt> defines the following interfaces and classes:</p>
<ul>
@@ -908,11 +761,24 @@ if (session.hasPermission("/content
<li><a href="/oak/docs/apidocs/org/apache/jackrabbit/oak/spi/security/authorization/permission/RepositoryPermission.html">RepositoryPermission</a>: Evaluates the repository level permissions, exposed by <tt>PermissionProvider</tt>.</li>
</ul></li>
+<li><a href="/oak/docs/apidocs/org/apache/jackrabbit/oak/spi/security/authorization/permission/AggregatedPermissionProvider.html">AggregatedPermissionProvider</a>: Extension of the <a href="/oak/docs/apidocs/org/apache/jackrabbit/oak/spi/security/authorization/permission/PermissionProvider.html">PermissionProvider</a> required for implementations that are intended to be used in an aggregation of multiple providers (since Oak 1.4)</li>
+
<li><a href="/oak/docs/apidocs/org/apache/jackrabbit/oak/spi/security/authorization/permission/Permissions.html">Permissions</a>: The permissions defined, respected and evaluated by the repository.</li>
<li><a href="/oak/docs/apidocs/org/apache/jackrabbit/oak/spi/security/authorization/permission/PermissionConstants.html">PermissionConstants</a>: Constants used throughout the permission evaluation.</li>
</ul></div>
<div class="section">
+<h3>Characteristics of the Permission Evaluation<a name="Characteristics_of_the_Permission_Evaluation"></a></h3>
+<p>As explained above permission evaluation is completely separated from the access control management and the associated ccontent. The evaluation itself is done by the configured <tt>PermissionProvider</tt>.</p>
+<p>Each JCR <tt>Session</tt> (and Oak <tt>ContentSession</tt>) gets it’s own <tt>PermissionProvider</tt> associated with the current repository revision the session is operating on. The evaluated permissions and caches are not shared between different sessions even if they represent the same subject.</p>
+<div class="section">
+<h4>Differences wrt Jackrabbit 2.x<a name="Differences_wrt_Jackrabbit_2.x"></a></h4>
+<p>see the corresponding <a href="permission/differences.html">documentation</a>.</p></div>
+<div class="section">
+<h4>Details on the Default Permission Evaluation<a name="Details_on_the_Default_Permission_Evaluation"></a></h4>
+<p>The behavior of the default permission implementation is described in sections <a href="permission/default.html">Permissions: The Default Implementation</a> and <a href="permission/evaluation.html">Permission Evaluation in Detail: The Default Implementation</a>.</p>
+<p><a name="configuration"></a></p></div></div>
+<div class="section">
<h3>Configuration<a name="Configuration"></a></h3>
<p>The configuration of the permission evaluation implementation is handled by the <a href="/oak/docs/apidocs/org/apache/jackrabbit/oak/spi/security/authorization/AuthorizationConfiguration.html">AuthorizationConfiguration</a>, which is used for all authorization related matters. This class provides the following two permission related methods:</p>
@@ -922,92 +788,11 @@ if (session.hasPermission("/content
</ul>
<div class="section">
<h4>Configuration Parameters<a name="Configuration_Parameters"></a></h4>
-<p>The default implementation supports the following configuration parameters:</p>
-
-<table border="0" class="table table-striped">
- <thead>
-
-<tr class="a">
-
-<th>Parameter </th>
-
-<th>Type </th>
-
-<th>Default </th>
-
-<th>Description </th>
- </tr>
- </thead>
- <tbody>
-
-<tr class="b">
-
-<td><tt>PARAM_PERMISSIONS_JR2</tt> </td>
-
-<td>String </td>
-
-<td>- </td>
-
-<td>Enables backwards compatible behavior for the permissions listed in the parameter value containing the permission names separated by ‘,’. Supported values are: <tt>USER_MANAGEMENT</tt>,<tt>REMOVE_NODE</tt> </td>
- </tr>
-
-<tr class="a">
-
-<td><tt>PARAM_READ_PATHS</tt> </td>
-
-<td>Set<String> </td>
-
-<td>paths to namespace, nodetype and privilege root nodes </td>
-
-<td>Set of paths that are always readable to all principals irrespective of other permissions defined at that path or inherited from other nodes. </td>
- </tr>
-
-<tr class="b">
-
-<td><tt>PARAM_ADMINISTRATIVE_PRINCIPALS</tt> </td>
-
-<td>String[] </td>
-
-<td>- </td>
-
-<td>The names of the additional principals that have full permission and for which the permission evaluation can be skipped altogether. </td>
- </tr>
-
-<tr class="a">
-
-<td> </td>
-
-<td> </td>
-
-<td> </td>
-
-<td> </td>
- </tr>
- </tbody>
-</table>
-<div class="section">
-<h5>Supported Values for PARAM_PERMISSIONS_JR2<a name="Supported_Values_for_PARAM_PERMISSIONS_JR2"></a></h5>
-
-<ul>
-
-<li><tt>REMOVE_NODE</tt>: if present, the permission evaluation will traverse down the hierarchy upon node removal. This config flag is a best effort approach but doesn’t guarantee an identical behavior.</li>
-
-<li><tt>USER_MANAGEMENT</tt>: if set permissions for user related items will be evaluated the same way as regular JCR items irrespective of their protection status.</li>
-</ul></div>
+<p>The supported configuration options of the default implementation are described in the corresponding <a href="permission/default.html#configuration">section</a>.</p>
<div class="section">
<h5>Differences to Jackrabbit 2.x<a name="Differences_to_Jackrabbit_2.x"></a></h5>
-<p>The <tt>omit-default-permission</tt> configuration option present with the Jackrabbit’s AccessControlProvider implementations is no longer supported with Oak. Since there are no permissions installed by default this flag has become superfluous.</p></div></div></div>
-<div class="section">
-<h3>Pluggability<a name="Pluggability"></a></h3>
-<p>There are two ways for plugging permission related custom implementations:</p>
-
-<ol style="list-style-type: decimal">
-
-<li>replace <tt>AuthorizationConfiguration</tt>: if you want to completely replace the way authorization is handled in the repository. In OSGi-base setup this is achieved by making the configuration implementation a service. In a non-OSGi-base setup the custom configuration must be exposed by the <tt>SecurityProvider</tt> implementation.</li>
-
-<li>extend <tt>AuthorizationConfiguration</tt>: it is planned to provide a <tt>CompositeAuthorizationConfiguration</tt> that allows to aggregate different authorization implementations (see <a class="externalLink" href="https://issues.apache.org/jira/browse/OAK-1268">OAK-1268</a>).</li>
-</ol>
-<!-- references --></div></div>
+<p>The <tt>omit-default-permission</tt> configuration option present with the Jackrabbit’s AccessControlProvider implementations is no longer supported with Oak. Since there are no permissions installed by default this flag has become superfluous.</p>
+<!-- references --></div></div></div></div>
</div>
</div>
</div>