You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@jackrabbit.apache.org by th...@apache.org on 2019/07/04 07:02:11 UTC
svn commit: r1862534 [6/8] - in /jackrabbit/site/live/oak/docs: ./
architecture/ coldstandby/ features/ nodestore/ nodestore/document/
nodestore/segment/ oak-mongo-js/ oak_api/ plugins/ query/ security/
security/accesscontrol/ security/authentication/ ...
Added: jackrabbit/site/live/oak/docs/security/authorization/principalbased.html
URL: http://svn.apache.org/viewvc/jackrabbit/site/live/oak/docs/security/authorization/principalbased.html?rev=1862534&view=auto
==============================================================================
--- jackrabbit/site/live/oak/docs/security/authorization/principalbased.html (added)
+++ jackrabbit/site/live/oak/docs/security/authorization/principalbased.html Thu Jul 4 07:02:09 2019
@@ -0,0 +1,648 @@
+<!DOCTYPE html>
+<!--
+ | Generated by Apache Maven Doxia Site Renderer 1.8.1 at 2019-07-03
+ | Rendered using Apache Maven Fluido Skin 1.6
+-->
+<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
+ <head>
+ <meta charset="UTF-8" />
+ <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+ <meta name="Date-Revision-yyyymmdd" content="20190703" />
+ <meta http-equiv="Content-Language" content="en" />
+ <title>Jackrabbit Oak – Managing Access by Principal</title>
+ <link rel="stylesheet" href="../../css/apache-maven-fluido-1.6.min.css" />
+ <link rel="stylesheet" href="../../css/site.css" />
+ <link rel="stylesheet" href="../../css/print.css" media="print" />
+ <script type="text/javascript" src="../../js/apache-maven-fluido-1.6.min.js"></script>
+ </head>
+ <body class="topBarEnabled">
+ <a href="https://github.com/apache/jackrabbit-oak">
+ <img style="position: absolute; top: 0; right: 0; border: 0; z-index: 10000;"
+ src="https://s3.amazonaws.com/github/ribbons/forkme_right_red_aa0000.png"
+ alt="Fork me on GitHub">
+ </a>
+ <div id="topbar" class="navbar navbar-fixed-top ">
+ <div class="navbar-inner">
+ <div class="container-fluid">
+ <a data-target=".nav-collapse" data-toggle="collapse" class="btn btn-navbar">
+ <span class="icon-bar"></span>
+ <span class="icon-bar"></span>
+ <span class="icon-bar"></span>
+ </a>
+<a class="brand" href="../../" title="Oak logo"><img src="../../oak_logo.png" alt="Oak logo" />
+</a>
+ <ul class="nav">
+ <li class="dropdown">
+ <a href="#" class="dropdown-toggle" data-toggle="dropdown">Overview <b class="caret"></b></a>
+ <ul class="dropdown-menu">
+ <li><a href="../../index.html" title="Jackrabbit Oak">Jackrabbit Oak</a></li>
+ <li><a href="../../license.html" title="License">License</a></li>
+ <li><a href="../../downloads.html" title="Downloads">Downloads</a></li>
+ <li><a href="../../articles.html" title="Articles">Articles</a></li>
+ </ul>
+ </li>
+ <li class="dropdown">
+ <a href="#" class="dropdown-toggle" data-toggle="dropdown">Concepts and Architecture <b class="caret"></b></a>
+ <ul class="dropdown-menu">
+ <li><a href="../../architecture/overview.html" title="Overview">Overview</a></li>
+ <li><a href="../../architecture/nodestate.html" title="The Node State Model">The Node State Model</a></li>
+ </ul>
+ </li>
+ <li class="dropdown">
+ <a href="#" class="dropdown-toggle" data-toggle="dropdown">Main APIs <b class="caret"></b></a>
+ <ul class="dropdown-menu">
+ <li><a href="https://docs.adobe.com/docs/en/spec/jcr/2.0/index.html" title="JCR API">JCR API</a></li>
+ <li><a href="https://jackrabbit.apache.org/jcr/jcr-api.html" title="Jackrabbit API">Jackrabbit API</a></li>
+ <li><a href="../../oak_api/overview.html" title="Oak API">Oak API</a></li>
+ </ul>
+ </li>
+ <li class="dropdown">
+ <a href="#" class="dropdown-toggle" data-toggle="dropdown">Features and Plugins <b class="caret"></b></a>
+ <ul class="dropdown-menu">
+ <li class="dropdown-submenu">
+<a href="../../nodestore/overview.html" title="Node Storage">Node Storage</a>
+ <ul class="dropdown-menu">
+ <li><a href="../../nodestore/documentmk.html" title="Document NodeStore">Document NodeStore</a></li>
+ <li><a href="../../nodestore/segment/overview.html" title="Segment NodeStore">Segment NodeStore</a></li>
+ <li><a href="../../nodestore/compositens.html" title="Composite NodeStore">Composite NodeStore</a></li>
+ </ul>
+ </li>
+ <li class="dropdown-submenu">
+<a href="../../plugins/blobstore.html" title="Blob Storage">Blob Storage</a>
+ <ul class="dropdown-menu">
+ <li><a href="../../features/direct-binary-access.html" title="Direct Binary Access">Direct Binary Access</a></li>
+ </ul>
+ </li>
+ <li class="dropdown-submenu">
+<a href="../../query/query.html" title="Query">Query</a>
+ <ul class="dropdown-menu">
+ <li><a href="../../query/query-engine.html" title="Query Engine">Query Engine</a></li>
+ <li><a href="../../query/grammar-xpath.html" title="XPath Grammar">XPath Grammar</a></li>
+ <li><a href="../../query/grammar-sql2.html" title="SQL-2 Grammar">SQL-2 Grammar</a></li>
+ <li><a href="../../query/query-troubleshooting.html" title="Troubleshooting">Troubleshooting</a></li>
+ <li><a href="../../query/indexing.html" title="Indexing">Indexing</a></li>
+ <li><a href="../../query/lucene.html" title="Lucene Index">Lucene Index</a></li>
+ <li><a href="../../query/property-index.html" title="Property Index">Property Index</a></li>
+ <li><a href="../../query/solr.html" title="Solr Index">Solr Index</a></li>
+ </ul>
+ </li>
+ <li class="dropdown-submenu">
+<a href="../../security/overview.html" title="Security">Security</a>
+ <ul class="dropdown-menu">
+ <li><a href="../../security/introduction.html" title="Introduction">Introduction</a></li>
+ <li><a href="../../security/authentication.html" title="Authentication">Authentication</a></li>
+ <li><a href="../../security/authorization.html" title="Authorization">Authorization</a></li>
+ <li><a href="../../security/principal.html" title="Principal Management">Principal Management</a></li>
+ <li><a href="../../security/user.html" title="User Management">User Management</a></li>
+ </ul>
+ </li>
+ <li><a href="../../features/atomic-counter.html" title="Atomic Counter">Atomic Counter</a></li>
+ <li><a href="../../features/observation.html" title="Observation">Observation</a></li>
+ </ul>
+ </li>
+ <li class="dropdown">
+ <a href="#" class="dropdown-toggle" data-toggle="dropdown">Using Oak <b class="caret"></b></a>
+ <ul class="dropdown-menu">
+ <li><a href="../../use_getting_started.html" title="Getting Started">Getting Started</a></li>
+ <li><a href="../../construct.html" title="Repository Construction">Repository Construction</a></li>
+ <li><a href="../../osgi_config.html" title="Configuring Oak">Configuring Oak</a></li>
+ <li><a href="../../command_line.html" title="Command Line Tools">Command Line Tools</a></li>
+ <li><a href="../../migration.html" title="Migration">Migration</a></li>
+ <li><a href="../../differences.html" title="Differences to Jackrabbit 2">Differences to Jackrabbit 2</a></li>
+ <li><a href="../../known_issues.html" title="Known Issues">Known Issues</a></li>
+ <li><a href="../../constraints.html" title="Constraints">Constraints</a></li>
+ <li><a href="../../dos_and_donts.html" title="Dos and Don'ts">Dos and Don'ts</a></li>
+ <li><a href="../../coldstandby/coldstandby.html" title="Cold Standby">Cold Standby</a></li>
+ <li><a href="../../FAQ.html" title="FAQ">FAQ</a></li>
+ </ul>
+ </li>
+ <li class="dropdown">
+ <a href="#" class="dropdown-toggle" data-toggle="dropdown">Developing Oak <b class="caret"></b></a>
+ <ul class="dropdown-menu">
+ <li><a href="../../dev_getting_started.html" title="Getting Started">Getting Started</a></li>
+ <li><a href="../../participating.html" title="Participating">Participating</a></li>
+ <li><a href="../../developing-with-git.html" title="Developing with Git">Developing with Git</a></li>
+ <li><a href="../../diagnostic-builds.html" title="Cutting diagnostic builds">Cutting diagnostic builds</a></li>
+ <li><a href="../../branching.html" title="Branching off a new stable">Branching off a new stable</a></li>
+ <li><a href="../../attribution.html" title="Attribution">Attribution</a></li>
+ <li><a href="../../release-schedule.html" title="Release Schedule">Release Schedule</a></li>
+ </ul>
+ </li>
+ <li class="dropdown">
+ <a href="#" class="dropdown-toggle" data-toggle="dropdown">Links <b class="caret"></b></a>
+ <ul class="dropdown-menu">
+ <li><a href="http://jackrabbit.apache.org/oak" title="Apache Jackrabbit Oak">Apache Jackrabbit Oak</a></li>
+ <li><a href="http://jackrabbit.apache.org/" title="Apache Jackrabbit">Apache Jackrabbit</a></li>
+ </ul>
+ </li>
+ </ul>
+ </div>
+ </div>
+ </div>
+ </div>
+ <div class="container-fluid">
+ <div id="banner">
+ <div class="pull-left"><div id="bannerLeft"><h2>Oak Documentation</h2>
+</div>
+</div>
+ <div class="pull-right"></div>
+ <div class="clear"><hr/></div>
+ </div>
+
+ <div id="breadcrumbs">
+ <ul class="breadcrumb">
+ <li id="publishDate">Last Published: 2019-07-03<span class="divider">|</span>
+</li>
+ <li id="projectVersion">Version: 1.14-SNAPSHOT</li>
+ </ul>
+ </div>
+ <div class="row-fluid">
+ <div id="leftColumn" class="span2">
+ <div class="well sidebar-nav">
+<ul class="nav nav-list">
+ <li class="nav-header">Overview</li>
+ <li><a href="../../index.html" title="Jackrabbit Oak"><span class="none"></span>Jackrabbit Oak</a> </li>
+ <li><a href="../../license.html" title="License"><span class="none"></span>License</a> </li>
+ <li><a href="../../downloads.html" title="Downloads"><span class="none"></span>Downloads</a> </li>
+ <li><a href="../../articles.html" title="Articles"><span class="none"></span>Articles</a> </li>
+ <li class="nav-header">Concepts and Architecture</li>
+ <li><a href="../../architecture/overview.html" title="Overview"><span class="none"></span>Overview</a> </li>
+ <li><a href="../../architecture/nodestate.html" title="The Node State Model"><span class="none"></span>The Node State Model</a> </li>
+ <li class="nav-header">Main APIs</li>
+ <li><a href="https://docs.adobe.com/docs/en/spec/jcr/2.0/index.html" class="externalLink" title="JCR API"><span class="none"></span>JCR API</a> </li>
+ <li><a href="https://jackrabbit.apache.org/jcr/jcr-api.html" class="externalLink" title="Jackrabbit API"><span class="none"></span>Jackrabbit API</a> </li>
+ <li><a href="../../oak_api/overview.html" title="Oak API"><span class="none"></span>Oak API</a> </li>
+ <li class="nav-header">Features and Plugins</li>
+ <li><a href="../../nodestore/overview.html" title="Node Storage"><span class="icon-chevron-down"></span>Node Storage</a>
+ <ul class="nav nav-list">
+ <li><a href="../../nodestore/documentmk.html" title="Document NodeStore"><span class="icon-chevron-down"></span>Document NodeStore</a>
+ <ul class="nav nav-list">
+ <li><a href="../../nodestore/document/mongo-document-store.html" title="MongoDB DocumentStore"><span class="none"></span>MongoDB DocumentStore</a> </li>
+ <li><a href="../../nodestore/document/rdb-document-store.html" title="RDB DocumentStore"><span class="none"></span>RDB DocumentStore</a> </li>
+ <li><a href="../../nodestore/document/node-bundling.html" title="Node Bundling"><span class="none"></span>Node Bundling</a> </li>
+ <li><a href="../../nodestore/document/secondary-store.html" title="Secondary Store"><span class="none"></span>Secondary Store</a> </li>
+ <li><a href="../../nodestore/persistent-cache.html" title="Persistent Cache"><span class="none"></span>Persistent Cache</a> </li>
+ <li><a href="../../clustering.html" title="Clustering"><span class="none"></span>Clustering</a> </li>
+ </ul>
+ </li>
+ <li><a href="../../nodestore/segment/overview.html" title="Segment NodeStore"><span class="none"></span>Segment NodeStore</a> </li>
+ <li><a href="../../nodestore/compositens.html" title="Composite NodeStore"><span class="none"></span>Composite NodeStore</a> </li>
+ </ul>
+ </li>
+ <li><a href="../../plugins/blobstore.html" title="Blob Storage"><span class="icon-chevron-down"></span>Blob Storage</a>
+ <ul class="nav nav-list">
+ <li><a href="../../features/direct-binary-access.html" title="Direct Binary Access"><span class="none"></span>Direct Binary Access</a> </li>
+ </ul>
+ </li>
+ <li><a href="../../query/query.html" title="Query"><span class="icon-chevron-down"></span>Query</a>
+ <ul class="nav nav-list">
+ <li><a href="../../query/query-engine.html" title="Query Engine"><span class="none"></span>Query Engine</a> </li>
+ <li><a href="../../query/grammar-xpath.html" title="XPath Grammar"><span class="none"></span>XPath Grammar</a> </li>
+ <li><a href="../../query/grammar-sql2.html" title="SQL-2 Grammar"><span class="none"></span>SQL-2 Grammar</a> </li>
+ <li><a href="../../query/query-troubleshooting.html" title="Troubleshooting"><span class="none"></span>Troubleshooting</a> </li>
+ <li><a href="../../query/indexing.html" title="Indexing"><span class="none"></span>Indexing</a> </li>
+ <li><a href="../../query/lucene.html" title="Lucene Index"><span class="none"></span>Lucene Index</a> </li>
+ <li><a href="../../query/property-index.html" title="Property Index"><span class="none"></span>Property Index</a> </li>
+ <li><a href="../../query/solr.html" title="Solr Index"><span class="none"></span>Solr Index</a> </li>
+ </ul>
+ </li>
+ <li><a href="../../security/overview.html" title="Security"><span class="icon-chevron-down"></span>Security</a>
+ <ul class="nav nav-list">
+ <li><a href="../../security/introduction.html" title="Introduction"><span class="none"></span>Introduction</a> </li>
+ <li><a href="../../security/authentication.html" title="Authentication"><span class="icon-chevron-right"></span>Authentication</a> </li>
+ <li><a href="../../security/authorization.html" title="Authorization"><span class="icon-chevron-down"></span>Authorization</a>
+ <ul class="nav nav-list">
+ <li><a href="../../security/accesscontrol.html" title="Access Control Management"><span class="icon-chevron-right"></span>Access Control Management</a> </li>
+ <li><a href="../../security/permission.html" title="Permission Evaluation"><span class="icon-chevron-right"></span>Permission Evaluation</a> </li>
+ <li><a href="../../security/privilege.html" title="Privilege Management"><span class="icon-chevron-right"></span>Privilege Management</a> </li>
+ <li><a href="javascript:void(0)" title="Extensions"><span class="icon-chevron-down"></span>Extensions</a>
+ <ul class="nav nav-list">
+ <li><a href="../../security/authorization/restriction.html" title="Restrictions"><span class="none"></span>Restrictions</a> </li>
+ <li><a href="../../security/authorization/composite.html" title="Multiple Models"><span class="none"></span>Multiple Models</a> </li>
+ <li><a href="../../security/authorization/cug.html" title="Closed User Groups"><span class="none"></span>Closed User Groups</a> </li>
+ <li class="active"><a href="#"><span class="none"></span>Principal Based</a>
+ </li>
+ </ul>
+ </li>
+ </ul>
+ </li>
+ <li><a href="../../security/principal.html" title="Principal Management"><span class="icon-chevron-right"></span>Principal Management</a> </li>
+ <li><a href="../../security/user.html" title="User Management"><span class="icon-chevron-right"></span>User Management</a> </li>
+ </ul>
+ </li>
+ <li><a href="../../features/atomic-counter.html" title="Atomic Counter"><span class="none"></span>Atomic Counter</a> </li>
+ <li><a href="../../features/observation.html" title="Observation"><span class="none"></span>Observation</a> </li>
+ <li class="nav-header">Using Oak</li>
+ <li><a href="../../use_getting_started.html" title="Getting Started"><span class="none"></span>Getting Started</a> </li>
+ <li><a href="../../construct.html" title="Repository Construction"><span class="none"></span>Repository Construction</a> </li>
+ <li><a href="../../osgi_config.html" title="Configuring Oak"><span class="none"></span>Configuring Oak</a> </li>
+ <li><a href="../../command_line.html" title="Command Line Tools"><span class="none"></span>Command Line Tools</a> </li>
+ <li><a href="../../migration.html" title="Migration"><span class="none"></span>Migration</a> </li>
+ <li><a href="../../differences.html" title="Differences to Jackrabbit 2"><span class="none"></span>Differences to Jackrabbit 2</a> </li>
+ <li><a href="../../known_issues.html" title="Known Issues"><span class="none"></span>Known Issues</a> </li>
+ <li><a href="../../constraints.html" title="Constraints"><span class="none"></span>Constraints</a> </li>
+ <li><a href="../../dos_and_donts.html" title="Dos and Don'ts"><span class="none"></span>Dos and Don'ts</a> </li>
+ <li><a href="../../coldstandby/coldstandby.html" title="Cold Standby"><span class="none"></span>Cold Standby</a> </li>
+ <li><a href="../../FAQ.html" title="FAQ"><span class="none"></span>FAQ</a> </li>
+ <li class="nav-header">Developing Oak</li>
+ <li><a href="../../dev_getting_started.html" title="Getting Started"><span class="none"></span>Getting Started</a> </li>
+ <li><a href="../../participating.html" title="Participating"><span class="none"></span>Participating</a> </li>
+ <li><a href="../../developing-with-git.html" title="Developing with Git"><span class="none"></span>Developing with Git</a> </li>
+ <li><a href="../../diagnostic-builds.html" title="Cutting diagnostic builds"><span class="none"></span>Cutting diagnostic builds</a> </li>
+ <li><a href="../../branching.html" title="Branching off a new stable"><span class="none"></span>Branching off a new stable</a> </li>
+ <li><a href="../../attribution.html" title="Attribution"><span class="none"></span>Attribution</a> </li>
+ <li><a href="../../release-schedule.html" title="Release Schedule"><span class="none"></span>Release Schedule</a> </li>
+ <li class="nav-header">Links</li>
+ <li><a href="http://jackrabbit.apache.org/oak" class="externalLink" title="Apache Jackrabbit Oak"><span class="none"></span>Apache Jackrabbit Oak</a> </li>
+ <li><a href="http://jackrabbit.apache.org/" class="externalLink" title="Apache Jackrabbit"><span class="none"></span>Apache Jackrabbit</a> </li>
+ </ul>
+ <hr />
+ <div id="poweredBy">
+ <script type="text/javascript">asyncJs( 'https://apis.google.com/js/plusone.js' )</script>
+ <div class="g-plusone" data-href="http://jackrabbit.apache.org/oak/docs/" data-size="tall" ></div>
+ <div class="clear"></div>
+ <div class="clear"></div>
+ <div class="clear"></div>
+ <div class="clear"></div>
+ <a href="http://maven.apache.org/" title="Built by Maven" class="poweredBy"><img class="builtBy" alt="Built by Maven" src="../../images/logos/maven-feather.png" /></a>
+ </div>
+ </div>
+ </div>
+ <div id="bodyColumn" class="span10" >
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements. See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+<div class="section">
+<h2><a name="Managing_Access_by_Principal"></a>Managing Access by Principal</h2>
+<div class="section">
+<h3><a name="General"></a>General</h3>
+<p>Oak 1.16.0 introduces a new, optional authorization model in the <tt>oak-authorization-principalbased</tt> module intended to be used in combination with the default implementation present with Apache Jackrabbit Oak. In contrast to the default authorization it provides native support for access control management based upon principals.</p>
+<p>The model leverages the fact that JSR 283 allows to redefine to scope of a given policy beyond the access controlled node it is bound to. Quoting section <a class="externalLink" href="https://docs.adobe.com/docs/en/spec/jcr/2.0/16_Access_Control_Management.html#16.3%20Access%20Control%20Policies">16.3 Access Control Policies</a> of JSR 283:</p>
+
+<div>
+<div>
+<pre class="source">Note that the scope of the effect of an access control policy may not be identical to the node to which that policy is bound.
+</pre></div></div>
+
+<p>The model is by default disabled and it requires manual <a href="#configuration">configuration</a> steps in order to add it to the Oak security setup. The configuration steps include defining which principals are supported and how to map them to an access controlled node in the repository that will hold the policy (see section <a href="#api_extensions">API Extensions</a>).</p>
+<p><a name="jackrabbit_api"></a></p></div>
+<div class="section">
+<h3><a name="Jackrabbit_API"></a>Jackrabbit API</h3>
+<p>Jackrabbit API 2.18 defines an extension of the <a class="externalLink" href="https://docs.adobe.com/docs/en/spec/jsr170/javadocs/jcr-2.0/javax/jcr/security/AccessControlList.html">AccessControlList</a> and <a class="externalLink" href="http://jackrabbit.apache.org/api/2.18/index.html?org/apache/jackrabbit/api/security/JackrabbitAccessControlList.html">JackrabbitAccessControlList</a> interfaces bound to a given <a class="externalLink" href="http://docs.oracle.com/javase/7/docs/api/java/security/Principal.html">Principal</a></p>
+<ul>
+
+<li><tt>PrincipalAccessControlList</tt></li>
+</ul>
+<p>The entries contained in this type of ACL are expected to be of type</p>
+<ul>
+
+<li><tt>PrincipalAccessControlList.Entry</tt></li>
+</ul>
+<p>which in addition to the methods inherited from <a class="externalLink" href="https://docs.adobe.com/docs/en/spec/jsr170/javadocs/jcr-2.0/javax/jcr/security/AccessControlEntry.html">AccessControlEntry</a> and <a class="externalLink" href="http://jackrabbit.apache.org/api/2.18/index.html?org/apache/jackrabbit/api/security/JackrabbitAccessControlEntry.html">JackrabbitAccessControlEntry</a> defined the absolute path where they will ultimately take effect. See Javadoc for <a class="externalLink" href="http://jackrabbit.apache.org/api/2.18/index.html?org/apache/jackrabbit/api/security/authorization/PrincipalAccessControlList.html">PrincipalAccessControlList</a> and <a class="externalLink" href="http://jackrabbit.apache.org/api/2.18/org/apache/jackrabbit/api/security/authorization/PrincipalAccessControlList.Entry.html">Entry</a> in Jackrabbit API 2.18 for additional details.</p>
+<p><a name="api_extensions"></a></p></div>
+<div class="section">
+<h3><a name="API_Extensions"></a>API Extensions</h3>
+<p>The module comes with the following extension in the <tt>org.apache.jackrabbit.oak.spi.security.authorization.principalbased</tt> package space:</p>
+<ul>
+
+<li><a href="/oak/docs/apidocs/org/apache/jackrabbit/oak/spi/security/authorization/principalbased/FilterProvider.html">FilterProvider</a></li>
+<li><a href="/oak/docs/apidocs/org/apache/jackrabbit/oak/spi/security/authorization/principalbased/Filter.html">Filter</a></li>
+</ul>
+<div class="section">
+<div class="section">
+<h5><a name="FilterProvider_and_Filter"></a>FilterProvider and Filter</h5>
+<p>In order to be operational the principal-based authorization needs to have a <tt>FilterProvider</tt> configured. The corresponding <tt>Filter</tt> defines if the model is able to evaluate permissions for a given set of principals. For any unsupported set of principals permission evaluation will be skipped altogether. Similarly, access control policies can only be obtained and modified for supported principals.</p>
+<p>Apart from validating principals the <tt>Filter</tt> interface is also responsible for mapping each supported principal to a location in the repository where the access control setup for that principal is being stored.</p>
+<p>See section <a href="#details">Implementation Details</a> for a description of the provider implementation present with the module. Section <a href="#pluggability">Pluggability</a> describes how to deploy a custom implementation.</p>
+<p><a name="details"></a></p></div></div></div>
+<div class="section">
+<h3><a name="Implementation_Details"></a>Implementation Details</h3>
+<p><a name="details_access_mgt"></a></p>
+<div class="section">
+<h4><a name="Access_Control_Management"></a>Access Control Management</h4>
+<p>The access control management follows the requirements defined by JSR 283 and the extensions defined by Jackrabbit API (see also section <a href="../accesscontrol.html">Access Control Management</a>).</p>
+<div class="section">
+<h5><a name="Access_Control_Policies"></a>Access Control Policies</h5>
+<p>The principal-based authorization model returns two types of policies:</p>
+<ul>
+
+<li><tt>PrincipalPolicyImpl</tt>: a mutable policy implementating <tt>PrincipalAccessControlList</tt>, which is returned upon <tt>JackrabbitAccessControlManager.getApplicablePolicies(Principal)</tt> and <tt>JackrabbitAccessControlManager.getPolicies(Principal)</tt>.</li>
+<li><tt>ImmutableACL</tt>: whenever effective policies are returned upon calling <tt>AccessControlManager.getEffectivePolicies(String)</tt> and <tt>JackrabbitAccessControlManager.getEffectivePolicies(Set<Principal>)</tt>.</li>
+</ul></div>
+<div class="section">
+<h5><a name="Management_by_Principal"></a>Management by Principal</h5>
+<p>In order to manage access control the Jackrabbit API extensions need to be used (see <a class="externalLink" href="http://jackrabbit.apache.org/api/2.18/index.html?org/apache/jackrabbit/api/security/JackrabbitAccessControlManager.html">JackrabbitAccessControlManager</a>).</p>
+<ul>
+
+<li><tt>JackrabbitAccessControlManager.getApplicablePolicies(Principal)</tt>: if the configured <tt>Filter</tt> handles the specified principal this method will return a single empty modifiable policy of type <tt>PrincipalAccessControlList</tt> if no policy has been set for the target principal before.</li>
+<li><tt>JackrabbitAccessControlManager.getPolicies(Principal)</tt>: once an applicable policy has been set, this method will return a single modifiable policy of type <tt>PrincipalAccessControlList</tt>.</li>
+</ul>
+<p>The following characteristics apply when modifying the <tt>PrincipalAccessControlList</tt> defined by this implementation:</p>
+<ul>
+
+<li>all entries will grant access (i.e. no <i>deny</i>)</li>
+<li>the effective path parameter must be an absolute JCR path or null for repository level privileges.</li>
+<li>the effective path may point to a non-existing node.</li>
+<li>the entry may define one or many supported privileges (see <tt>AccessControlManager.getSupportedPrivileges(String absPath)</tt> and <b>Supported Privileges</b> below)</li>
+<li>additional restrictions may optionally be specified according to <tt>JackrabbitAccessControlList.getRestrictionNames</tt> (see <b>Supported Restrictions</b> below)</li>
+<li>entries will be added to the list in the order they are created</li>
+<li>while equal entries will not be added to the list, no additional effort is made to avoid or cleanup redundant entries.</li>
+<li>entries can be reordered within the list (<tt>JackrabbitAccessControlList.orderBefore</tt>) but this doesn’t impact the net effect (no denies).</li>
+</ul>
+<p>Since <tt>PrincipalAccessControlList</tt> extends <tt>JackrabbitAccessControlList</tt>, new entries can also be added using variants of the <tt>addEntry</tt> method. Please note the following principles:</p>
+<ul>
+
+<li>the specified <tt>Principal</tt> must be equal to the principal for which the policy was obtained</li>
+<li>only <i>allow</i> entries are supported (see above)</li>
+<li>the entry may define one or many supported privileges (see <tt>AccessControlManager.getSupportedPrivileges(String absPath)</tt> and <b>Supported Privileges</b> below)</li>
+<li>the new entry must come with a single value <i>rep:nodePath</i> restriction specifying the absolute JCR path where this policy will take effect. To indicate that the entry takes effect at the repository level an empty string value is used.</li>
+<li>additional restrictions may optionally be specified according to <tt>JackrabbitAccessControlList.getRestrictionNames</tt> (see <b>Supported Restrictions</b> below)</li>
+</ul>
+<p>The path of the policies (<tt>JackrabbitAccessControlPolicy.getPath</tt>) is defined by the configured <tt>Filter</tt> implementation and will be used to persist the modified policy (<tt>AccessControlManager.setPolicy(String, AccessControlPolicy)</tt>) or remove it (<tt>AccessControlManager.removePolicy(String, AccessControlPolicy)</tt>).</p>
+<p>Both operations require the editing session to have <i>jcr:modifyAccessControl</i> privilege granted at the access controlled node that will hold the policy. Since the access control entries contained in the policy will take effect at the tree defined by <a class="externalLink" href="http://jackrabbit.apache.org/api/2.18/org/apache/jackrabbit/api/security/authorization/PrincipalAccessControlList.Entry.html#getEffectivePath">Entry.getEffectivePath()</a>, the editing session <b>in addition</b> needs permission to modify access control content at the path defined with each individual entry. This contrasts the default implementation where a given entry only takes effect at the tree defined by the access controlled node.</p></div>
+<div class="section">
+<h5><a name="Management_by_Path"></a>Management by Path</h5>
+<p>Editing access control by path is not supported with the principal-based access control manager. Consequently, <tt>AccessControlManager.getApplicablePolicies(String)</tt> and <tt>AccessControlManager.getPolicies(String)</tt> will return an empty iterator/array.</p>
+<p>Note however that <tt>AccessControlManager.getEffectivePolicies(String)</tt> will make a best-effort approach searching for entries that take effect at a given absolute path: the query will look for nodes of type <i>rep:PrincipalEntry</i> that have a property <i>rep:effectivePath</i> matching the target path or any of its ancestors. Restrictions limiting the effect of a given entry are not taken into account. See also JSR 283 section <a class="externalLink" href="https://docs.adobe.com/docs/en/spec/jcr/2.0/16_Access_Control_Management.html#16.3.5%20Scope%20of%20a%20Policy">16.3.5 Scope of a Policy</a> in JSR 283.</p></div>
+<div class="section">
+<h5><a name="Supported_Privileges"></a>Supported Privileges</h5>
+<p>All privileges registered with the repository are supported by this authorization model.</p></div>
+<div class="section">
+<h5><a name="Supported_Restrictions"></a>Supported Restrictions</h5>
+<p>The principal-based authorization model doesn’t come with a dedicated <tt>RestrictionProvider</tt>. Instead it is built to handle any restriction defined by the Oak authorization setup.</p>
+<p><a name="details_permission_eval"></a></p></div></div>
+<div class="section">
+<h4><a name="Permission_Evaluation"></a>Permission Evaluation</h4>
+<p>If a given set of principals is supported by the configured <tt>FilterProvider/Filter</tt> implementation, the principal-based authorization model will contribute an implementation of <tt>AggregatedPermissionProvider</tt> to the composite. Whether or not access will be granted depends on the aggregated providers and their ranking, the composition type and whether or not an <tt>AggregationFilter</tt> is defined for the setup (see also section <a href="composite.html">Combining Multiple Authorization Models</a> for details).</p>
+<p>If the set of principals is not supported an <tt>EmptyPermissionProvider</tt> will be returned and the model will be ignored altogether. It follows that in this case permission evaluation delegated to other authorization modules configured in the composite.</p>
+<div class="section">
+<h5><a name="Reading_and_Caching"></a>Reading and Caching</h5>
+<p>Once permission evalution is triggered the principal-based model will directly read the effective permissions from the persisted access control content. There exists no separate location for permissions like the <a href="../permission/default.html#permissionStore">permission store</a> present with the default implementation.</p>
+<p>All entries defined for a given set of principal are eagerly loaded from the access control content and kept in memory for each instance of <tt>ContentSession</tt>. This applies to all supported principals irrespective of the size of the individual policies or the size of the principal set.</p>
+<p>Note, that the intended use-case for this authorization model expects small sets of system user principals each with a limited set of permissions, which result in comparably small ACLs. See <a class="externalLink" href="https://issues.apache.org/jira/browse/OAK-8227">OAK-8227</a> for benchmark series that measure read operations with increasing number of entries and principals.</p></div>
+<div class="section">
+<h5><a name="Permission_Inheritance"></a>Permission Inheritance</h5>
+<p>In contrast to the default permission evalution the principal-based setup makes no distinction between user and group principals nor does’t make any assumptions about the order of principals computed and placed in the <tt>Subject</tt> upon login. The inheritance model only takes the item hierarchy into account. In other words the evaluation process will start at the target item and search up the item hierarchy for a matching entry. An entry is considered matching if it is defined for any of the principals in the given set, applies to the target item and grants the specified permissions.</p></div>
+<div class="section">
+<h5><a name="Allowed_if_Granted"></a>Allowed if Granted</h5>
+<p>As soon as an entry matches the target item and grants the requested permission the evaluation will stop. As this model only supports allowing entries there exists no particular requirement to maintain and handle the order of entries for different principals that take effect at a given target.</p>
+<p>However, in order to minimize excessive read on the <tt>NodeStore</tt> it is recommended to avoid fully redundant entries such as e.g.</p>
+<ul>
+
+<li><i>entry:</i> granting privileges, <i>redundant</i>: same privileges with additional restrictions</li>
+<li><i>entry:</i> granting privileges, <i>redundant:</i> subset of these privileges</li>
+</ul></div>
+<div class="section">
+<h5><a name="Administrative_Access"></a>Administrative Access</h5>
+<p>The principal-based authorization doesn’t enforce any special handling for administrative principals. When implementing a custom <tt>FilterProvider</tt> this should be part of the considerations. An implementation may e.g. choose not to support administrative principals and thus delegate the permission evalution to the default implementation.</p></div>
+<div class="section">
+<h5><a name="Permission_Evaluation_with_Multiplexed_Stores"></a>Permission Evaluation with Multiplexed Stores</h5>
+<p>This authorization model can be used in combinition with non-default mounts with one notable limitation: None of the non-default mounts may be located below the configured filter root (see <tt>FilterProvider.getFilterRoot()</tt>) in order to make sure that all policies managemed and evaluated by this model are residing the same mount.</p>
+<p><a name="details_filterprovider"></a></p></div></div>
+<div class="section">
+<h4><a name="FilterProvider_Implementation"></a>FilterProvider Implementation</h4>
+<p>The model comes with an implementation of the <tt>FilterProvider</tt> and <tt>Filter</tt> interfaces which (if enabled) will limit the scope of the principal-based authorization according to the following rules:</p>
+<ul>
+
+<li>the set of principals must not be empty and must only contain <tt>SystemUserPrincipal</tt>s</li>
+<li>each <tt>SystemUserPrincipal</tt> must be associated with a location in the repository (i.e. must be <tt>ItemBasedPrincipal</tt> when obtained through principal management API).</li>
+<li>all principals must additionally be located below the path configured with <tt>FilterProviderImpl</tt> (see <a href="#configuration">below</a></li>
+</ul>
+<p>So, if this implementation is enabled the principal-based authorization will only take effect for <tt>SystemUserPrincipal</tt>s that are created below the configured path. As soon as a given <tt>Subject</tt> or set of principals contains principals that doesn’t match the filter definition (e.g. group principals, principals not located in the repository or located elsewhere in the repository), principal-based authorization will be skipped. This applies both to permission evaluation and to access control management.</p>
+<p><a name="details_aggregationfilter"></a></p></div>
+<div class="section">
+<h4><a name="AggregationFilter_Implementation"></a>AggregationFilter Implementation</h4>
+<p>In addition principal-based authorization provides a implementation of the <a href="composite.html#api_extensions">AggregationFilter</a> interface that stops the aggregation of <tt>PermissionProvider</tt>s and effective policies as soon as the <tt>PrincipalBasedPermissionProvider</tt> takes effect (i.e. the mandatory <tt>FilterProvider</tt> will handle a given set of principals). The <tt>AggregationFilter</tt> can be enabled by setting the corresponding flag with the module <a href="#configuration">configuration</a>.</p>
+<p><a name="representation"></a></p></div></div>
+<div class="section">
+<h3><a name="Representation_in_the_Repository"></a>Representation in the Repository</h3>
+<p>The access control lists defined by this module are represented by nodes named <tt>rep:principalPolicy</tt> with primary node type <tt>rep:PrincipalPolicy</tt>. The declaring mixin type of this policy node is <tt>rep:PrincipalBasedMixin</tt> (according to <tt>rep:AccessControllable</tt>). The policy node has a single mandatory, protected property containing the name of principal this policy is bound to and a list of entries of type <tt>rep:PrincipalEntry</tt>. Apart from mandatory privileges and optional restrictions each entry defines the target path (<tt>rep:effectivePath</tt>), where it will take effect upon successful commit.</p>
+
+<div>
+<div>
+<pre class="source">/**
+ * @since oak 1.14
+ */
+[rep:PrincipalBasedMixin]
+ mixin
+ + rep:principalPolicy (rep:PrincipalPolicy) protected IGNORE
+
+/**
+ * @since oak 1.14
+ */
+[rep:PrincipalPolicy] > rep:Policy
+ orderable
+ - rep:principalName (STRING) protected mandatory IGNORE
+ + * (rep:PrincipalEntry) = rep:PrincipalEntry protected IGNORE
+
+/**
+ * @since oak 1.14
+ */
+[rep:PrincipalEntry]
+ - rep:effectivePath (PATH) protected mandatory
+ - rep:privileges (NAME) multiple protected mandatory multiple
+ + rep:restrictions (rep:Restrictions) = rep:Restrictions protected
+</pre></div></div>
+
+<p><i>Note:</i> While the definition of the <tt>rep:principalName</tt> property doesn’t mandate any particular value, it is the mandatory <tt>FilterProvider</tt> implementation that will ultimately define, for which types of principals this type of policy can be created and where these principals are to be located in the repository.</p>
+<p><a name="validation"></a></p></div>
+<div class="section">
+<h3><a name="Validation"></a>Validation</h3>
+<p>The validity of the content structure is asserted by a dedicated <tt>Validator</tt> on creation and modification. The following commit failures of type <tt>AccessControl</tt> may occur:</p>
+<table border="0" class="table table-striped">
+<thead>
+
+<tr class="a">
+<th> Code </th>
+<th> Message </th></tr>
+</thead><tbody>
+
+<tr class="b">
+<td> 0030 </td>
+<td> Attempt create policy node with different name than rep:principalPolicy </td></tr>
+<tr class="a">
+<td> 0031 </td>
+<td> Attempt to change primary type from/to rep:PrincipalPolicy </td></tr>
+<tr class="b">
+<td> 0032 </td>
+<td> Reserved node name ‘rep:principalPolicy’ must only be used for nodes of type ‘rep:PrincipalPolicy’ </td></tr>
+<tr class="a">
+<td> 0033 </td>
+<td> Parent node not of mixin type ‘rep:PrincipalBasedMixin’ </td></tr>
+<tr class="b">
+<td> 0034 </td>
+<td> Reserved node name ‘rep:restrictions’ must only be used for nodes of type ‘rep:Restrictions’ </td></tr>
+<tr class="a">
+<td> 0035 </td>
+<td> Invalid restriction </td></tr>
+<tr class="b">
+<td> 0002 </td>
+<td> Expected access control entry parent (isolated restriction) </td></tr>
+<tr class="a">
+<td> 0036 </td>
+<td> Isolated entry of principal policy </td></tr>
+<tr class="b">
+<td> 0037 </td>
+<td> Empty rep:privileges property </td></tr>
+<tr class="a">
+<td> 0038 </td>
+<td> Abstract privilege </td></tr>
+<tr class="b">
+<td> 0039 </td>
+<td> Invalid privilege </td></tr>
+</tbody>
+</table>
+<p>Note, that the validator performs additional checks regarding ability to modify access control content that will take effect at the location indicated by the <tt>rep:effectivePath</tt> property. In case the editing session doesn’t have sufficient permissions at the target location the commit will fail with an error of type <tt>Access</tt>:</p>
+<table border="0" class="table table-striped">
+<thead>
+
+<tr class="a">
+<th> Code </th>
+<th> Message </th></tr>
+</thead><tbody>
+
+<tr class="b">
+<td> 0003 </td>
+<td> Access denied: If editing session is not granted modify access content at effective target path </td></tr>
+</tbody>
+</table>
+<p><a name="configuration"></a></p></div>
+<div class="section">
+<h3><a name="Configuration"></a>Configuration</h3>
+<div class="section">
+<h4><a name="Configuration_Parameters"></a>Configuration Parameters</h4>
+<p>The <tt>org.apache.jackrabbit.oak.spi.security.authorization.principalbased.impl.PrincipalBasedAuthorizationConfiguration</tt> defines the following configuration parameters:</p>
+<table border="0" class="table table-striped">
+<thead>
+
+<tr class="a">
+<th> Parameter </th>
+<th> Type </th>
+<th> Default </th>
+<th> Description </th></tr>
+</thead><tbody>
+
+<tr class="b">
+<td> <tt>PARAM_ENABLE_AGGREGATION_FILTER</tt> </td>
+<td> boolean </td>
+<td> false </td>
+<td> Flag to enable the aggregration filter. </td></tr>
+<tr class="a">
+<td> <tt>PARAM_RANKING</tt> </td>
+<td> int </td>
+<td> 500 </td>
+<td> Ranking within the composite authorization setup. </td></tr>
+</tbody>
+</table>
+<p>The principal-based authorization in addition requires a <tt>FilterProvider</tt> to be configured along side with it in order to be operational (mandatory reference in an OSGi setup). This could either be the example implementation present with the module or a custom implementation.</p></div>
+<div class="section">
+<h4><a name="FilterProvider_Implementation"></a>FilterProvider Implementation</h4>
+<p>The <tt>FilterProvider</tt> implementation present with the module limits the effect to system users principals located below the configured subtree. The absolute path of this subtree is a mandatory configuration option with the <tt>Apache Jackrabbit Oak Filter for Principal Based Authorization</tt> (<i>ConfigurationPolicy.REQUIRE</i>):</p>
+<table border="0" class="table table-striped">
+<thead>
+
+<tr class="a">
+<th> Parameter </th>
+<th> Type </th>
+<th> Default </th>
+<th> Description </th></tr>
+</thead><tbody>
+
+<tr class="b">
+<td> <tt>Path</tt> </td>
+<td> String </td>
+<td> - </td>
+<td> Required path underneath which all filtered system user principals must be located in the repository.</td></tr>
+</tbody>
+</table>
+<p><i>Note:</i> It is equally possible to plug a custom <tt>FilterProvider</tt> implementation matching specific needs (see <a href="#pluggability">below</a>).</p>
+<p><a name="pluggability"></a></p></div></div>
+<div class="section">
+<h3><a name="Pluggability"></a>Pluggability</h3>
+<p>The following section describes how to deploy this authorization model into an Oak repository and how to customize the <tt>FilterProvider</tt> extension point.</p>
+<div class="section">
+<h4><a name="Deploy_PrincipalBasedAuthorizationConfiguration"></a>Deploy PrincipalBasedAuthorizationConfiguration</h4>
+<div class="section">
+<h5><a name="OSGi_Setup"></a>OSGi Setup</h5>
+<p>The following steps are required in order to deploy the CUG authorization model in an OSGi-base Oak repository:</p>
+<ol style="list-style-type: decimal">
+
+<li>Deploy the <tt>oak-authorization-principalbased</tt> bundle</li>
+<li>Configure and activate the built-in <tt>FilterProvider</tt> or deploy a custom implementation (see below).</li>
+<li>Make sure you have the default or a custom <tt>MountInfoProvider</tt> service running</li>
+<li>Optionally configure the <tt>PrincipalBasedAuthorizationConfiguration</tt> <i>(“Apache Jackrabbit Oak Principal Based AuthorizationConfiguration”)</i></li>
+<li>Find the <tt>SecurityProviderRegistration</tt> <i>(“Apache Jackrabbit Oak SecurityProvider”)</i> configuration and enter <i><tt>org.apache.jackrabbit.oak.spi.security.authorization.principalbased.impl.PrincipalBasedAuthorizationConfiguration</tt></i> as additional value to the <tt>requiredServicePids</tt> property.</li>
+</ol>
+<p>The third step will enforce the recreation of the <tt>SecurityProvider</tt> and hence trigger the <tt>RepositoryInitializer</tt> provided by the principal-based authorization module, that will make sure the required node type definitions are installed.</p></div>
+<div class="section">
+<h5><a name="Non-OSGi_Setup"></a>Non-OSGi Setup</h5>
+<p>The following example shows a simplified setup that contains the <tt>PrincipalBasedAuthorizationConfiguration</tt> as additional authorization model (second position in the aggregation). See also unit tests for an alternative approach.</p>
+
+<div>
+<div>
+<pre class="source"> // setup PrincipalBasedAuthorizationConfiguration
+ FilterProvider filterProvider = TODO: define the filter provider;
+ MountInfoProvider mip = Mounts.defaultMountInfoProvider();
+
+ PrincipalBasedAuthorizationConfiguration ac = new PrincipalBasedAuthorizationConfiguration();
+ ac.bindFilterProvider(filterProvider);
+ ac.bindMountInfoProvider(mip);
+ // optionally set configuration parameters: ranking, enable aggregationfilter
+
+ // bind it to the security provider
+ ConfigurationParameters securityConfig = ConfigurationParameters.EMPTY; // TODO define security config options
+ SecurityProvider securityProvider = SecurityProviderBuilder.newBuilder().with(securityConfig)
+ .withRootProvider(rootProvider)
+ .withTreeProvider(treeProvider)
+ .build();
+ SecurityProviderHelper.updateConfig(securityProvider, ac, AuthorizationConfiguration.class);
+
+ // create the Oak repository (alternatively: create the JCR repository)
+ Oak oak = new Oak()
+ .with(new InitialContent())
+ // TODO: add all required editors
+ .with(securityProvider);
+ withEditors(oak);
+ ContentRepository contentRepository = oak.createContentRepository();
+</pre></div></div>
+</div></div>
+<div class="section">
+<h4><a name="Customize_FilterProvider"></a>Customize FilterProvider</h4>
+<p>The following steps are required in order to customize the <tt>FilterProvider</tt> implementation in a OSGi-based repository setup. Ultimately the implementation needs to be referenced in the <tt>org.apache.jackrabbit.oak.spi.security.authorization.principalbased.impl.PrincipalBasedAuthorizationConfiguration</tt>.</p>
+<ol style="list-style-type: decimal">
+
+<li>implement <tt>FilterProvider</tt> and <tt>Filter</tt> interface according to you needs,</li>
+<li>make your <tt>FilterProvider</tt> implementation an OSGi service</li>
+<li>deploy the bundle containing your implementation in the OSGi container and activate the service.</li>
+</ol><!-- hidden references --></div></div></div>
+ </div>
+ </div>
+ </div>
+ <hr/>
+ <footer>
+ <div class="container-fluid">
+ <div class="row-fluid">
+ <p>Copyright ©2012–2019
+<a href="https://www.apache.org/">The Apache Software Foundation</a>.
+All rights reserved.</p>
+ </div>
+ <div id="ohloh" class="pull-right">
+ <script type="text/javascript" src="https://www.ohloh.net/p/jackrabbit-oak/widgets/project_thin_badge.js"></script>
+ </div>
+ </div>
+ </footer>
+ </body>
+</html>
\ No newline at end of file
Modified: jackrabbit/site/live/oak/docs/security/authorization/restriction.html
URL: http://svn.apache.org/viewvc/jackrabbit/site/live/oak/docs/security/authorization/restriction.html?rev=1862534&r1=1862533&r2=1862534&view=diff
==============================================================================
--- jackrabbit/site/live/oak/docs/security/authorization/restriction.html (original)
+++ jackrabbit/site/live/oak/docs/security/authorization/restriction.html Thu Jul 4 07:02:09 2019
@@ -1,13 +1,13 @@
<!DOCTYPE html>
<!--
- | Generated by Apache Maven Doxia Site Renderer 1.8.1 at 2019-06-12
+ | Generated by Apache Maven Doxia Site Renderer 1.8.1 at 2019-01-08
| Rendered using Apache Maven Fluido Skin 1.6
-->
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
- <meta name="Date-Revision-yyyymmdd" content="20190612" />
+ <meta name="Date-Revision-yyyymmdd" content="20190108" />
<meta http-equiv="Content-Language" content="en" />
<title>Jackrabbit Oak – Restriction Management</title>
<link rel="stylesheet" href="../../css/apache-maven-fluido-1.6.min.css" />
@@ -51,7 +51,7 @@
<li class="dropdown">
<a href="#" class="dropdown-toggle" data-toggle="dropdown">Main APIs <b class="caret"></b></a>
<ul class="dropdown-menu">
- <li><a href="https://docs.adobe.com/docs/en/spec/jcr/2.0/index.html" title="JCR API">JCR API</a></li>
+ <li><a href="http://www.day.com/specs/jcr/2.0/index.html" title="JCR API">JCR API</a></li>
<li><a href="https://jackrabbit.apache.org/jcr/jcr-api.html" title="Jackrabbit API">Jackrabbit API</a></li>
<li><a href="../../oak_api/overview.html" title="Oak API">Oak API</a></li>
</ul>
@@ -142,9 +142,9 @@
<div id="breadcrumbs">
<ul class="breadcrumb">
- <li id="publishDate">Last Published: 2019-06-12<span class="divider">|</span>
+ <li id="publishDate">Last Published: 2019-01-08<span class="divider">|</span>
</li>
- <li id="projectVersion">Version: 1.14-SNAPSHOT</li>
+ <li id="projectVersion">Version: 1.10-SNAPSHOT</li>
</ul>
</div>
<div class="row-fluid">
@@ -160,7 +160,7 @@
<li><a href="../../architecture/overview.html" title="Overview"><span class="none"></span>Overview</a> </li>
<li><a href="../../architecture/nodestate.html" title="The Node State Model"><span class="none"></span>The Node State Model</a> </li>
<li class="nav-header">Main APIs</li>
- <li><a href="https://docs.adobe.com/docs/en/spec/jcr/2.0/index.html" class="externalLink" title="JCR API"><span class="none"></span>JCR API</a> </li>
+ <li><a href="http://www.day.com/specs/jcr/2.0/index.html" class="externalLink" title="JCR API"><span class="none"></span>JCR API</a> </li>
<li><a href="https://jackrabbit.apache.org/jcr/jcr-api.html" class="externalLink" title="Jackrabbit API"><span class="none"></span>Jackrabbit API</a> </li>
<li><a href="../../oak_api/overview.html" title="Oak API"><span class="none"></span>Oak API</a> </li>
<li class="nav-header">Features and Plugins</li>
@@ -169,7 +169,6 @@
<li><a href="../../nodestore/documentmk.html" title="Document NodeStore"><span class="icon-chevron-down"></span>Document NodeStore</a>
<ul class="nav nav-list">
<li><a href="../../nodestore/document/mongo-document-store.html" title="MongoDB DocumentStore"><span class="none"></span>MongoDB DocumentStore</a> </li>
- <li><a href="../../nodestore/document/rdb-document-store.html" title="RDB DocumentStore"><span class="none"></span>RDB DocumentStore</a> </li>
<li><a href="../../nodestore/document/node-bundling.html" title="Node Bundling"><span class="none"></span>Node Bundling</a> </li>
<li><a href="../../nodestore/document/secondary-store.html" title="Secondary Store"><span class="none"></span>Secondary Store</a> </li>
<li><a href="../../nodestore/persistent-cache.html" title="Persistent Cache"><span class="none"></span>Persistent Cache</a> </li>
Modified: jackrabbit/site/live/oak/docs/security/introduction.html
URL: http://svn.apache.org/viewvc/jackrabbit/site/live/oak/docs/security/introduction.html?rev=1862534&r1=1862533&r2=1862534&view=diff
==============================================================================
--- jackrabbit/site/live/oak/docs/security/introduction.html (original)
+++ jackrabbit/site/live/oak/docs/security/introduction.html Thu Jul 4 07:02:09 2019
@@ -1,13 +1,13 @@
<!DOCTYPE html>
<!--
- | Generated by Apache Maven Doxia Site Renderer 1.8.1 at 2019-06-12
+ | Generated by Apache Maven Doxia Site Renderer 1.8.1 at 2019-01-08
| Rendered using Apache Maven Fluido Skin 1.6
-->
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
- <meta name="Date-Revision-yyyymmdd" content="20190612" />
+ <meta name="Date-Revision-yyyymmdd" content="20190108" />
<meta http-equiv="Content-Language" content="en" />
<title>Jackrabbit Oak – Introduction to Oak Security</title>
<link rel="stylesheet" href="../css/apache-maven-fluido-1.6.min.css" />
@@ -51,7 +51,7 @@
<li class="dropdown">
<a href="#" class="dropdown-toggle" data-toggle="dropdown">Main APIs <b class="caret"></b></a>
<ul class="dropdown-menu">
- <li><a href="https://docs.adobe.com/docs/en/spec/jcr/2.0/index.html" title="JCR API">JCR API</a></li>
+ <li><a href="http://www.day.com/specs/jcr/2.0/index.html" title="JCR API">JCR API</a></li>
<li><a href="https://jackrabbit.apache.org/jcr/jcr-api.html" title="Jackrabbit API">Jackrabbit API</a></li>
<li><a href="../oak_api/overview.html" title="Oak API">Oak API</a></li>
</ul>
@@ -142,9 +142,9 @@
<div id="breadcrumbs">
<ul class="breadcrumb">
- <li id="publishDate">Last Published: 2019-06-12<span class="divider">|</span>
+ <li id="publishDate">Last Published: 2019-01-08<span class="divider">|</span>
</li>
- <li id="projectVersion">Version: 1.14-SNAPSHOT</li>
+ <li id="projectVersion">Version: 1.10-SNAPSHOT</li>
</ul>
</div>
<div class="row-fluid">
@@ -160,7 +160,7 @@
<li><a href="../architecture/overview.html" title="Overview"><span class="none"></span>Overview</a> </li>
<li><a href="../architecture/nodestate.html" title="The Node State Model"><span class="none"></span>The Node State Model</a> </li>
<li class="nav-header">Main APIs</li>
- <li><a href="https://docs.adobe.com/docs/en/spec/jcr/2.0/index.html" class="externalLink" title="JCR API"><span class="none"></span>JCR API</a> </li>
+ <li><a href="http://www.day.com/specs/jcr/2.0/index.html" class="externalLink" title="JCR API"><span class="none"></span>JCR API</a> </li>
<li><a href="https://jackrabbit.apache.org/jcr/jcr-api.html" class="externalLink" title="Jackrabbit API"><span class="none"></span>Jackrabbit API</a> </li>
<li><a href="../oak_api/overview.html" title="Oak API"><span class="none"></span>Oak API</a> </li>
<li class="nav-header">Features and Plugins</li>
@@ -169,7 +169,6 @@
<li><a href="../nodestore/documentmk.html" title="Document NodeStore"><span class="icon-chevron-down"></span>Document NodeStore</a>
<ul class="nav nav-list">
<li><a href="../nodestore/document/mongo-document-store.html" title="MongoDB DocumentStore"><span class="none"></span>MongoDB DocumentStore</a> </li>
- <li><a href="../nodestore/document/rdb-document-store.html" title="RDB DocumentStore"><span class="none"></span>RDB DocumentStore</a> </li>
<li><a href="../nodestore/document/node-bundling.html" title="Node Bundling"><span class="none"></span>Node Bundling</a> </li>
<li><a href="../nodestore/document/secondary-store.html" title="Secondary Store"><span class="none"></span>Secondary Store</a> </li>
<li><a href="../nodestore/persistent-cache.html" title="Persistent Cache"><span class="none"></span>Persistent Cache</a> </li>
Modified: jackrabbit/site/live/oak/docs/security/overview.html
URL: http://svn.apache.org/viewvc/jackrabbit/site/live/oak/docs/security/overview.html?rev=1862534&r1=1862533&r2=1862534&view=diff
==============================================================================
--- jackrabbit/site/live/oak/docs/security/overview.html (original)
+++ jackrabbit/site/live/oak/docs/security/overview.html Thu Jul 4 07:02:09 2019
@@ -1,13 +1,13 @@
<!DOCTYPE html>
<!--
- | Generated by Apache Maven Doxia Site Renderer 1.8.1 at 2019-06-12
+ | Generated by Apache Maven Doxia Site Renderer 1.8.1 at 2019-07-03
| Rendered using Apache Maven Fluido Skin 1.6
-->
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
- <meta name="Date-Revision-yyyymmdd" content="20190612" />
+ <meta name="Date-Revision-yyyymmdd" content="20190703" />
<meta http-equiv="Content-Language" content="en" />
<title>Jackrabbit Oak – The Oak Security Layer</title>
<link rel="stylesheet" href="../css/apache-maven-fluido-1.6.min.css" />
@@ -86,7 +86,16 @@
<li><a href="../query/solr.html" title="Solr Index">Solr Index</a></li>
</ul>
</li>
- <li><a href="../security/overview.html" title="Security">Security</a></li>
+ <li class="dropdown-submenu">
+<a href="../security/overview.html" title="Security">Security</a>
+ <ul class="dropdown-menu">
+ <li><a href="../security/introduction.html" title="Introduction">Introduction</a></li>
+ <li><a href="../security/authentication.html" title="Authentication">Authentication</a></li>
+ <li><a href="../security/authorization.html" title="Authorization">Authorization</a></li>
+ <li><a href="../security/principal.html" title="Principal Management">Principal Management</a></li>
+ <li><a href="../security/user.html" title="User Management">User Management</a></li>
+ </ul>
+ </li>
<li><a href="../features/atomic-counter.html" title="Atomic Counter">Atomic Counter</a></li>
<li><a href="../features/observation.html" title="Observation">Observation</a></li>
</ul>
@@ -142,7 +151,7 @@
<div id="breadcrumbs">
<ul class="breadcrumb">
- <li id="publishDate">Last Published: 2019-06-12<span class="divider">|</span>
+ <li id="publishDate">Last Published: 2019-07-03<span class="divider">|</span>
</li>
<li id="projectVersion">Version: 1.14-SNAPSHOT</li>
</ul>
@@ -197,7 +206,15 @@
<li><a href="../query/solr.html" title="Solr Index"><span class="none"></span>Solr Index</a> </li>
</ul>
</li>
- <li class="active"><a href="#"><span class="none"></span>Security</a>
+ <li class="active"><a href="#"><span class="icon-chevron-down"></span>Security</a>
+
+ <ul class="nav nav-list">
+ <li><a href="../security/introduction.html" title="Introduction"><span class="none"></span>Introduction</a> </li>
+ <li><a href="../security/authentication.html" title="Authentication"><span class="icon-chevron-right"></span>Authentication</a> </li>
+ <li><a href="../security/authorization.html" title="Authorization"><span class="icon-chevron-right"></span>Authorization</a> </li>
+ <li><a href="../security/principal.html" title="Principal Management"><span class="icon-chevron-right"></span>Principal Management</a> </li>
+ <li><a href="../security/user.html" title="User Management"><span class="icon-chevron-right"></span>User Management</a> </li>
+ </ul>
</li>
<li><a href="../features/atomic-counter.html" title="Atomic Counter"><span class="none"></span>Atomic Counter</a> </li>
<li><a href="../features/observation.html" title="Observation"><span class="none"></span>Observation</a> </li>
@@ -293,7 +310,7 @@
<ul>
<li><a href="accesscontrol.html">Access Control Management</a></li>
-<li><a href="permission.html">Permission Evalution</a></li>
+<li><a href="permission.html">Permission Evaluation</a></li>
<li><a href="authorization/composite.html">Combining Multiple Authorization Models</a></li>
</ul>
</li>
@@ -346,6 +363,7 @@
<li><a href="authorization/restriction.html">Restriction Management</a></li>
<li><a href="authorization/cug.html">Managing Access with Closed User Groups (CUG)</a></li>
+<li><a href="authorization/principalbased.html">Managing Access by Principal</a></li>
</ul></div></div>
<div class="section">
<h3><a name="Principal_Management"></a>Principal Management</h3>
@@ -353,6 +371,7 @@
<li><a href="principal.html">Overview</a></li>
<li><a href="principal/differences.html">Differences wrt Jackrabbit 2.x</a></li>
+<li><a href="principal.html#default_implementation">Principal Management : The Default Implementation</a></li>
</ul></div>
<div class="section">
<h3><a name="User_Management"></a>User Management</h3>
Modified: jackrabbit/site/live/oak/docs/security/permission.html
URL: http://svn.apache.org/viewvc/jackrabbit/site/live/oak/docs/security/permission.html?rev=1862534&r1=1862533&r2=1862534&view=diff
==============================================================================
--- jackrabbit/site/live/oak/docs/security/permission.html (original)
+++ jackrabbit/site/live/oak/docs/security/permission.html Thu Jul 4 07:02:09 2019
@@ -1,13 +1,13 @@
<!DOCTYPE html>
<!--
- | Generated by Apache Maven Doxia Site Renderer 1.8.1 at 2019-06-12
+ | Generated by Apache Maven Doxia Site Renderer 1.8.1 at 2019-01-08
| Rendered using Apache Maven Fluido Skin 1.6
-->
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
- <meta name="Date-Revision-yyyymmdd" content="20190612" />
+ <meta name="Date-Revision-yyyymmdd" content="20190108" />
<meta http-equiv="Content-Language" content="en" />
<title>Jackrabbit Oak – Permissions</title>
<link rel="stylesheet" href="../css/apache-maven-fluido-1.6.min.css" />
@@ -51,7 +51,7 @@
<li class="dropdown">
<a href="#" class="dropdown-toggle" data-toggle="dropdown">Main APIs <b class="caret"></b></a>
<ul class="dropdown-menu">
- <li><a href="https://docs.adobe.com/docs/en/spec/jcr/2.0/index.html" title="JCR API">JCR API</a></li>
+ <li><a href="http://www.day.com/specs/jcr/2.0/index.html" title="JCR API">JCR API</a></li>
<li><a href="https://jackrabbit.apache.org/jcr/jcr-api.html" title="Jackrabbit API">Jackrabbit API</a></li>
<li><a href="../oak_api/overview.html" title="Oak API">Oak API</a></li>
</ul>
@@ -142,9 +142,9 @@
<div id="breadcrumbs">
<ul class="breadcrumb">
- <li id="publishDate">Last Published: 2019-06-12<span class="divider">|</span>
+ <li id="publishDate">Last Published: 2019-01-08<span class="divider">|</span>
</li>
- <li id="projectVersion">Version: 1.14-SNAPSHOT</li>
+ <li id="projectVersion">Version: 1.10-SNAPSHOT</li>
</ul>
</div>
<div class="row-fluid">
@@ -160,7 +160,7 @@
<li><a href="../architecture/overview.html" title="Overview"><span class="none"></span>Overview</a> </li>
<li><a href="../architecture/nodestate.html" title="The Node State Model"><span class="none"></span>The Node State Model</a> </li>
<li class="nav-header">Main APIs</li>
- <li><a href="https://docs.adobe.com/docs/en/spec/jcr/2.0/index.html" class="externalLink" title="JCR API"><span class="none"></span>JCR API</a> </li>
+ <li><a href="http://www.day.com/specs/jcr/2.0/index.html" class="externalLink" title="JCR API"><span class="none"></span>JCR API</a> </li>
<li><a href="https://jackrabbit.apache.org/jcr/jcr-api.html" class="externalLink" title="Jackrabbit API"><span class="none"></span>Jackrabbit API</a> </li>
<li><a href="../oak_api/overview.html" title="Oak API"><span class="none"></span>Oak API</a> </li>
<li class="nav-header">Features and Plugins</li>
@@ -169,7 +169,6 @@
<li><a href="../nodestore/documentmk.html" title="Document NodeStore"><span class="icon-chevron-down"></span>Document NodeStore</a>
<ul class="nav nav-list">
<li><a href="../nodestore/document/mongo-document-store.html" title="MongoDB DocumentStore"><span class="none"></span>MongoDB DocumentStore</a> </li>
- <li><a href="../nodestore/document/rdb-document-store.html" title="RDB DocumentStore"><span class="none"></span>RDB DocumentStore</a> </li>
<li><a href="../nodestore/document/node-bundling.html" title="Node Bundling"><span class="none"></span>Node Bundling</a> </li>
<li><a href="../nodestore/document/secondary-store.html" title="Secondary Store"><span class="none"></span>Secondary Store</a> </li>
<li><a href="../nodestore/persistent-cache.html" title="Persistent Cache"><span class="none"></span>Persistent Cache</a> </li>
Modified: jackrabbit/site/live/oak/docs/security/permission/default.html
URL: http://svn.apache.org/viewvc/jackrabbit/site/live/oak/docs/security/permission/default.html?rev=1862534&r1=1862533&r2=1862534&view=diff
==============================================================================
--- jackrabbit/site/live/oak/docs/security/permission/default.html (original)
+++ jackrabbit/site/live/oak/docs/security/permission/default.html Thu Jul 4 07:02:09 2019
@@ -1,13 +1,13 @@
<!DOCTYPE html>
<!--
- | Generated by Apache Maven Doxia Site Renderer 1.8.1 at 2019-06-12
+ | Generated by Apache Maven Doxia Site Renderer 1.8.1 at 2019-01-08
| Rendered using Apache Maven Fluido Skin 1.6
-->
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
- <meta name="Date-Revision-yyyymmdd" content="20190612" />
+ <meta name="Date-Revision-yyyymmdd" content="20190108" />
<meta http-equiv="Content-Language" content="en" />
<title>Jackrabbit Oak – Permissions : The Default Implementation</title>
<link rel="stylesheet" href="../../css/apache-maven-fluido-1.6.min.css" />
@@ -51,7 +51,7 @@
<li class="dropdown">
<a href="#" class="dropdown-toggle" data-toggle="dropdown">Main APIs <b class="caret"></b></a>
<ul class="dropdown-menu">
- <li><a href="https://docs.adobe.com/docs/en/spec/jcr/2.0/index.html" title="JCR API">JCR API</a></li>
+ <li><a href="http://www.day.com/specs/jcr/2.0/index.html" title="JCR API">JCR API</a></li>
<li><a href="https://jackrabbit.apache.org/jcr/jcr-api.html" title="Jackrabbit API">Jackrabbit API</a></li>
<li><a href="../../oak_api/overview.html" title="Oak API">Oak API</a></li>
</ul>
@@ -142,9 +142,9 @@
<div id="breadcrumbs">
<ul class="breadcrumb">
- <li id="publishDate">Last Published: 2019-06-12<span class="divider">|</span>
+ <li id="publishDate">Last Published: 2019-01-08<span class="divider">|</span>
</li>
- <li id="projectVersion">Version: 1.14-SNAPSHOT</li>
+ <li id="projectVersion">Version: 1.10-SNAPSHOT</li>
</ul>
</div>
<div class="row-fluid">
@@ -160,7 +160,7 @@
<li><a href="../../architecture/overview.html" title="Overview"><span class="none"></span>Overview</a> </li>
<li><a href="../../architecture/nodestate.html" title="The Node State Model"><span class="none"></span>The Node State Model</a> </li>
<li class="nav-header">Main APIs</li>
- <li><a href="https://docs.adobe.com/docs/en/spec/jcr/2.0/index.html" class="externalLink" title="JCR API"><span class="none"></span>JCR API</a> </li>
+ <li><a href="http://www.day.com/specs/jcr/2.0/index.html" class="externalLink" title="JCR API"><span class="none"></span>JCR API</a> </li>
<li><a href="https://jackrabbit.apache.org/jcr/jcr-api.html" class="externalLink" title="Jackrabbit API"><span class="none"></span>Jackrabbit API</a> </li>
<li><a href="../../oak_api/overview.html" title="Oak API"><span class="none"></span>Oak API</a> </li>
<li class="nav-header">Features and Plugins</li>
@@ -169,7 +169,6 @@
<li><a href="../../nodestore/documentmk.html" title="Document NodeStore"><span class="icon-chevron-down"></span>Document NodeStore</a>
<ul class="nav nav-list">
<li><a href="../../nodestore/document/mongo-document-store.html" title="MongoDB DocumentStore"><span class="none"></span>MongoDB DocumentStore</a> </li>
- <li><a href="../../nodestore/document/rdb-document-store.html" title="RDB DocumentStore"><span class="none"></span>RDB DocumentStore</a> </li>
<li><a href="../../nodestore/document/node-bundling.html" title="Node Bundling"><span class="none"></span>Node Bundling</a> </li>
<li><a href="../../nodestore/document/secondary-store.html" title="Secondary Store"><span class="none"></span>Secondary Store</a> </li>
<li><a href="../../nodestore/persistent-cache.html" title="Persistent Cache"><span class="none"></span>Persistent Cache</a> </li>
Modified: jackrabbit/site/live/oak/docs/security/permission/differences.html
URL: http://svn.apache.org/viewvc/jackrabbit/site/live/oak/docs/security/permission/differences.html?rev=1862534&r1=1862533&r2=1862534&view=diff
==============================================================================
--- jackrabbit/site/live/oak/docs/security/permission/differences.html (original)
+++ jackrabbit/site/live/oak/docs/security/permission/differences.html Thu Jul 4 07:02:09 2019
@@ -1,13 +1,13 @@
<!DOCTYPE html>
<!--
- | Generated by Apache Maven Doxia Site Renderer 1.8.1 at 2019-06-12
+ | Generated by Apache Maven Doxia Site Renderer 1.8.1 at 2019-01-08
| Rendered using Apache Maven Fluido Skin 1.6
-->
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
- <meta name="Date-Revision-yyyymmdd" content="20190612" />
+ <meta name="Date-Revision-yyyymmdd" content="20190108" />
<meta http-equiv="Content-Language" content="en" />
<title>Jackrabbit Oak – Permissions : Differences wrt Jackrabbit 2.x</title>
<link rel="stylesheet" href="../../css/apache-maven-fluido-1.6.min.css" />
@@ -51,7 +51,7 @@
<li class="dropdown">
<a href="#" class="dropdown-toggle" data-toggle="dropdown">Main APIs <b class="caret"></b></a>
<ul class="dropdown-menu">
- <li><a href="https://docs.adobe.com/docs/en/spec/jcr/2.0/index.html" title="JCR API">JCR API</a></li>
+ <li><a href="http://www.day.com/specs/jcr/2.0/index.html" title="JCR API">JCR API</a></li>
<li><a href="https://jackrabbit.apache.org/jcr/jcr-api.html" title="Jackrabbit API">Jackrabbit API</a></li>
<li><a href="../../oak_api/overview.html" title="Oak API">Oak API</a></li>
</ul>
@@ -142,9 +142,9 @@
<div id="breadcrumbs">
<ul class="breadcrumb">
- <li id="publishDate">Last Published: 2019-06-12<span class="divider">|</span>
+ <li id="publishDate">Last Published: 2019-01-08<span class="divider">|</span>
</li>
- <li id="projectVersion">Version: 1.14-SNAPSHOT</li>
+ <li id="projectVersion">Version: 1.10-SNAPSHOT</li>
</ul>
</div>
<div class="row-fluid">
@@ -160,7 +160,7 @@
<li><a href="../../architecture/overview.html" title="Overview"><span class="none"></span>Overview</a> </li>
<li><a href="../../architecture/nodestate.html" title="The Node State Model"><span class="none"></span>The Node State Model</a> </li>
<li class="nav-header">Main APIs</li>
- <li><a href="https://docs.adobe.com/docs/en/spec/jcr/2.0/index.html" class="externalLink" title="JCR API"><span class="none"></span>JCR API</a> </li>
+ <li><a href="http://www.day.com/specs/jcr/2.0/index.html" class="externalLink" title="JCR API"><span class="none"></span>JCR API</a> </li>
<li><a href="https://jackrabbit.apache.org/jcr/jcr-api.html" class="externalLink" title="Jackrabbit API"><span class="none"></span>Jackrabbit API</a> </li>
<li><a href="../../oak_api/overview.html" title="Oak API"><span class="none"></span>Oak API</a> </li>
<li class="nav-header">Features and Plugins</li>
@@ -169,7 +169,6 @@
<li><a href="../../nodestore/documentmk.html" title="Document NodeStore"><span class="icon-chevron-down"></span>Document NodeStore</a>
<ul class="nav nav-list">
<li><a href="../../nodestore/document/mongo-document-store.html" title="MongoDB DocumentStore"><span class="none"></span>MongoDB DocumentStore</a> </li>
- <li><a href="../../nodestore/document/rdb-document-store.html" title="RDB DocumentStore"><span class="none"></span>RDB DocumentStore</a> </li>
<li><a href="../../nodestore/document/node-bundling.html" title="Node Bundling"><span class="none"></span>Node Bundling</a> </li>
<li><a href="../../nodestore/document/secondary-store.html" title="Secondary Store"><span class="none"></span>Secondary Store</a> </li>
<li><a href="../../nodestore/persistent-cache.html" title="Persistent Cache"><span class="none"></span>Persistent Cache</a> </li>
Modified: jackrabbit/site/live/oak/docs/security/permission/evaluation.html
URL: http://svn.apache.org/viewvc/jackrabbit/site/live/oak/docs/security/permission/evaluation.html?rev=1862534&r1=1862533&r2=1862534&view=diff
==============================================================================
--- jackrabbit/site/live/oak/docs/security/permission/evaluation.html (original)
+++ jackrabbit/site/live/oak/docs/security/permission/evaluation.html Thu Jul 4 07:02:09 2019
@@ -1,13 +1,13 @@
<!DOCTYPE html>
<!--
- | Generated by Apache Maven Doxia Site Renderer 1.8.1 at 2019-06-12
+ | Generated by Apache Maven Doxia Site Renderer 1.8.1 at 2019-01-08
| Rendered using Apache Maven Fluido Skin 1.6
-->
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
- <meta name="Date-Revision-yyyymmdd" content="20190612" />
+ <meta name="Date-Revision-yyyymmdd" content="20190108" />
<meta http-equiv="Content-Language" content="en" />
<title>Jackrabbit Oak – Permission Evaluation in Detail</title>
<link rel="stylesheet" href="../../css/apache-maven-fluido-1.6.min.css" />
@@ -51,7 +51,7 @@
<li class="dropdown">
<a href="#" class="dropdown-toggle" data-toggle="dropdown">Main APIs <b class="caret"></b></a>
<ul class="dropdown-menu">
- <li><a href="https://docs.adobe.com/docs/en/spec/jcr/2.0/index.html" title="JCR API">JCR API</a></li>
+ <li><a href="http://www.day.com/specs/jcr/2.0/index.html" title="JCR API">JCR API</a></li>
<li><a href="https://jackrabbit.apache.org/jcr/jcr-api.html" title="Jackrabbit API">Jackrabbit API</a></li>
<li><a href="../../oak_api/overview.html" title="Oak API">Oak API</a></li>
</ul>
@@ -142,9 +142,9 @@
<div id="breadcrumbs">
<ul class="breadcrumb">
- <li id="publishDate">Last Published: 2019-06-12<span class="divider">|</span>
+ <li id="publishDate">Last Published: 2019-01-08<span class="divider">|</span>
</li>
- <li id="projectVersion">Version: 1.14-SNAPSHOT</li>
+ <li id="projectVersion">Version: 1.10-SNAPSHOT</li>
</ul>
</div>
<div class="row-fluid">
@@ -160,7 +160,7 @@
<li><a href="../../architecture/overview.html" title="Overview"><span class="none"></span>Overview</a> </li>
<li><a href="../../architecture/nodestate.html" title="The Node State Model"><span class="none"></span>The Node State Model</a> </li>
<li class="nav-header">Main APIs</li>
- <li><a href="https://docs.adobe.com/docs/en/spec/jcr/2.0/index.html" class="externalLink" title="JCR API"><span class="none"></span>JCR API</a> </li>
+ <li><a href="http://www.day.com/specs/jcr/2.0/index.html" class="externalLink" title="JCR API"><span class="none"></span>JCR API</a> </li>
<li><a href="https://jackrabbit.apache.org/jcr/jcr-api.html" class="externalLink" title="Jackrabbit API"><span class="none"></span>Jackrabbit API</a> </li>
<li><a href="../../oak_api/overview.html" title="Oak API"><span class="none"></span>Oak API</a> </li>
<li class="nav-header">Features and Plugins</li>
@@ -169,7 +169,6 @@
<li><a href="../../nodestore/documentmk.html" title="Document NodeStore"><span class="icon-chevron-down"></span>Document NodeStore</a>
<ul class="nav nav-list">
<li><a href="../../nodestore/document/mongo-document-store.html" title="MongoDB DocumentStore"><span class="none"></span>MongoDB DocumentStore</a> </li>
- <li><a href="../../nodestore/document/rdb-document-store.html" title="RDB DocumentStore"><span class="none"></span>RDB DocumentStore</a> </li>
<li><a href="../../nodestore/document/node-bundling.html" title="Node Bundling"><span class="none"></span>Node Bundling</a> </li>
<li><a href="../../nodestore/document/secondary-store.html" title="Secondary Store"><span class="none"></span>Secondary Store</a> </li>
<li><a href="../../nodestore/persistent-cache.html" title="Persistent Cache"><span class="none"></span>Persistent Cache</a> </li>
Modified: jackrabbit/site/live/oak/docs/security/permission/multiplexing.html
URL: http://svn.apache.org/viewvc/jackrabbit/site/live/oak/docs/security/permission/multiplexing.html?rev=1862534&r1=1862533&r2=1862534&view=diff
==============================================================================
--- jackrabbit/site/live/oak/docs/security/permission/multiplexing.html (original)
+++ jackrabbit/site/live/oak/docs/security/permission/multiplexing.html Thu Jul 4 07:02:09 2019
@@ -1,13 +1,13 @@
<!DOCTYPE html>
<!--
- | Generated by Apache Maven Doxia Site Renderer 1.8.1 at 2019-06-12
+ | Generated by Apache Maven Doxia Site Renderer 1.8.1 at 2019-01-08
| Rendered using Apache Maven Fluido Skin 1.6
-->
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
- <meta name="Date-Revision-yyyymmdd" content="20190612" />
+ <meta name="Date-Revision-yyyymmdd" content="20190108" />
<meta http-equiv="Content-Language" content="en" />
<title>Jackrabbit Oak – Multiplexing support in the PermissionStore</title>
<link rel="stylesheet" href="../../css/apache-maven-fluido-1.6.min.css" />
@@ -51,7 +51,7 @@
<li class="dropdown">
<a href="#" class="dropdown-toggle" data-toggle="dropdown">Main APIs <b class="caret"></b></a>
<ul class="dropdown-menu">
- <li><a href="https://docs.adobe.com/docs/en/spec/jcr/2.0/index.html" title="JCR API">JCR API</a></li>
+ <li><a href="http://www.day.com/specs/jcr/2.0/index.html" title="JCR API">JCR API</a></li>
<li><a href="https://jackrabbit.apache.org/jcr/jcr-api.html" title="Jackrabbit API">Jackrabbit API</a></li>
<li><a href="../../oak_api/overview.html" title="Oak API">Oak API</a></li>
</ul>
@@ -142,9 +142,9 @@
<div id="breadcrumbs">
<ul class="breadcrumb">
- <li id="publishDate">Last Published: 2019-06-12<span class="divider">|</span>
+ <li id="publishDate">Last Published: 2019-01-08<span class="divider">|</span>
</li>
- <li id="projectVersion">Version: 1.14-SNAPSHOT</li>
+ <li id="projectVersion">Version: 1.10-SNAPSHOT</li>
</ul>
</div>
<div class="row-fluid">
@@ -160,7 +160,7 @@
<li><a href="../../architecture/overview.html" title="Overview"><span class="none"></span>Overview</a> </li>
<li><a href="../../architecture/nodestate.html" title="The Node State Model"><span class="none"></span>The Node State Model</a> </li>
<li class="nav-header">Main APIs</li>
- <li><a href="https://docs.adobe.com/docs/en/spec/jcr/2.0/index.html" class="externalLink" title="JCR API"><span class="none"></span>JCR API</a> </li>
+ <li><a href="http://www.day.com/specs/jcr/2.0/index.html" class="externalLink" title="JCR API"><span class="none"></span>JCR API</a> </li>
<li><a href="https://jackrabbit.apache.org/jcr/jcr-api.html" class="externalLink" title="Jackrabbit API"><span class="none"></span>Jackrabbit API</a> </li>
<li><a href="../../oak_api/overview.html" title="Oak API"><span class="none"></span>Oak API</a> </li>
<li class="nav-header">Features and Plugins</li>
@@ -169,7 +169,6 @@
<li><a href="../../nodestore/documentmk.html" title="Document NodeStore"><span class="icon-chevron-down"></span>Document NodeStore</a>
<ul class="nav nav-list">
<li><a href="../../nodestore/document/mongo-document-store.html" title="MongoDB DocumentStore"><span class="none"></span>MongoDB DocumentStore</a> </li>
- <li><a href="../../nodestore/document/rdb-document-store.html" title="RDB DocumentStore"><span class="none"></span>RDB DocumentStore</a> </li>
<li><a href="../../nodestore/document/node-bundling.html" title="Node Bundling"><span class="none"></span>Node Bundling</a> </li>
<li><a href="../../nodestore/document/secondary-store.html" title="Secondary Store"><span class="none"></span>Secondary Store</a> </li>
<li><a href="../../nodestore/persistent-cache.html" title="Persistent Cache"><span class="none"></span>Persistent Cache</a> </li>
Modified: jackrabbit/site/live/oak/docs/security/permission/permissionsandprivileges.html
URL: http://svn.apache.org/viewvc/jackrabbit/site/live/oak/docs/security/permission/permissionsandprivileges.html?rev=1862534&r1=1862533&r2=1862534&view=diff
==============================================================================
--- jackrabbit/site/live/oak/docs/security/permission/permissionsandprivileges.html (original)
+++ jackrabbit/site/live/oak/docs/security/permission/permissionsandprivileges.html Thu Jul 4 07:02:09 2019
@@ -1,13 +1,13 @@
<!DOCTYPE html>
<!--
- | Generated by Apache Maven Doxia Site Renderer 1.8.1 at 2019-06-12
+ | Generated by Apache Maven Doxia Site Renderer 1.8.1 at 2019-01-08
| Rendered using Apache Maven Fluido Skin 1.6
-->
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
- <meta name="Date-Revision-yyyymmdd" content="20190612" />
+ <meta name="Date-Revision-yyyymmdd" content="20190108" />
<meta http-equiv="Content-Language" content="en" />
<title>Jackrabbit Oak – Permissions vs Privileges</title>
<link rel="stylesheet" href="../../css/apache-maven-fluido-1.6.min.css" />
@@ -51,7 +51,7 @@
<li class="dropdown">
<a href="#" class="dropdown-toggle" data-toggle="dropdown">Main APIs <b class="caret"></b></a>
<ul class="dropdown-menu">
- <li><a href="https://docs.adobe.com/docs/en/spec/jcr/2.0/index.html" title="JCR API">JCR API</a></li>
+ <li><a href="http://www.day.com/specs/jcr/2.0/index.html" title="JCR API">JCR API</a></li>
<li><a href="https://jackrabbit.apache.org/jcr/jcr-api.html" title="Jackrabbit API">Jackrabbit API</a></li>
<li><a href="../../oak_api/overview.html" title="Oak API">Oak API</a></li>
</ul>
@@ -142,9 +142,9 @@
<div id="breadcrumbs">
<ul class="breadcrumb">
- <li id="publishDate">Last Published: 2019-06-12<span class="divider">|</span>
+ <li id="publishDate">Last Published: 2019-01-08<span class="divider">|</span>
</li>
- <li id="projectVersion">Version: 1.14-SNAPSHOT</li>
+ <li id="projectVersion">Version: 1.10-SNAPSHOT</li>
</ul>
</div>
<div class="row-fluid">
@@ -160,7 +160,7 @@
<li><a href="../../architecture/overview.html" title="Overview"><span class="none"></span>Overview</a> </li>
<li><a href="../../architecture/nodestate.html" title="The Node State Model"><span class="none"></span>The Node State Model</a> </li>
<li class="nav-header">Main APIs</li>
- <li><a href="https://docs.adobe.com/docs/en/spec/jcr/2.0/index.html" class="externalLink" title="JCR API"><span class="none"></span>JCR API</a> </li>
+ <li><a href="http://www.day.com/specs/jcr/2.0/index.html" class="externalLink" title="JCR API"><span class="none"></span>JCR API</a> </li>
<li><a href="https://jackrabbit.apache.org/jcr/jcr-api.html" class="externalLink" title="Jackrabbit API"><span class="none"></span>Jackrabbit API</a> </li>
<li><a href="../../oak_api/overview.html" title="Oak API"><span class="none"></span>Oak API</a> </li>
<li class="nav-header">Features and Plugins</li>
@@ -169,7 +169,6 @@
<li><a href="../../nodestore/documentmk.html" title="Document NodeStore"><span class="icon-chevron-down"></span>Document NodeStore</a>
<ul class="nav nav-list">
<li><a href="../../nodestore/document/mongo-document-store.html" title="MongoDB DocumentStore"><span class="none"></span>MongoDB DocumentStore</a> </li>
- <li><a href="../../nodestore/document/rdb-document-store.html" title="RDB DocumentStore"><span class="none"></span>RDB DocumentStore</a> </li>
<li><a href="../../nodestore/document/node-bundling.html" title="Node Bundling"><span class="none"></span>Node Bundling</a> </li>
<li><a href="../../nodestore/document/secondary-store.html" title="Secondary Store"><span class="none"></span>Secondary Store</a> </li>
<li><a href="../../nodestore/persistent-cache.html" title="Persistent Cache"><span class="none"></span>Persistent Cache</a> </li>