You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@sling.apache.org by ol...@apache.org on 2020/12/03 10:17:30 UTC
[sling-org-apache-sling-karaf-configs] branch master updated
(ac3e755 -> 2a6008e)
This is an automated email from the ASF dual-hosted git repository.
olli pushed a change to branch master
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-karaf-configs.git.
from ac3e755 rename service user sling-jcr-install to sling-installer-jcr
new 610eab8 SLING-9690 Configure best-effort import behaviour for access control items
new 6db91b2 SLING-9685 Support principal-based authentication
new 508c320 SLING-9786 Use pre-authentication for system users
new 2a6008e add configs for usermanager and adjust whitelist
The 4 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
....security.authorization.AuthorizationConfigurationImpl.config | 1 +
...bit.oak.security.internal.SecurityProviderRegistration.config | 9 +++++++++
...y.authorization.principalbased.impl.FilterProviderImpl.config | 1 +
...palbased.impl.PrincipalBasedAuthorizationConfiguration.config | 1 +
...r.base.internal.LoginAdminWhitelist.fragment~sling_jcr.config | 1 -
...RepositoryInitializer~sling_jcr_jackrabbit_usermanager.config | 3 +++
...ping.impl.ServiceUserMapperImpl.amended~sling_caconfig.config | 2 +-
...rmapping.impl.ServiceUserMapperImpl.amended~sling_clam.config | 4 ++--
...ing.impl.ServiceUserMapperImpl.amended~sling_discovery.config | 6 +++---
...mapping.impl.ServiceUserMapperImpl.amended~sling_event.config | 4 ++--
...rmapping.impl.ServiceUserMapperImpl.amended~sling_i18n.config | 2 +-
...impl.ServiceUserMapperImpl.amended~sling_installer_jcr.config | 2 +-
....ServiceUserMapperImpl.amended~sling_jcr_contentloader.config | 2 +-
...serMapperImpl.amended~sling_jcr_jackrabbit_usermanager.config | 3 +++
....impl.ServiceUserMapperImpl.amended~sling_jcr_resource.config | 4 ++--
....ServiceUserMapperImpl.amended~sling_resource_presence.config | 2 +-
...l.ServiceUserMapperImpl.amended~sling_resourceresolver.config | 8 ++++----
...ping.impl.ServiceUserMapperImpl.amended~sling_rewriter.config | 2 +-
...ing.impl.ServiceUserMapperImpl.amended~sling_scripting.config | 2 +-
...impl.ServiceUserMapperImpl.amended~sling_scripting_htl.config | 2 +-
...erviceUserMapperImpl.amended~sling_scripting_thymeleaf.config | 2 +-
...ping.impl.ServiceUserMapperImpl.amended~sling_servlets.config | 4 ++--
...ng.impl.ServiceUserMapperImpl.amended~sling_validation.config | 2 +-
...ermapping.impl.ServiceUserMapperImpl.amended~sling_xss.config | 2 +-
src/main/resources/sling-clam.txt | 4 ++--
src/main/resources/sling-discovery.txt | 7 +++----
src/main/resources/sling-event.txt | 4 ++--
src/main/resources/sling-i18n.txt | 4 ++--
src/main/resources/sling-installer-jcr.txt | 4 ++--
src/main/resources/sling-jcr-contentloader.txt | 4 ++--
src/main/resources/sling-jcr-jackrabbit-usermanager.txt | 5 +++++
src/main/resources/sling-mapping.txt | 4 ++--
src/main/resources/sling-readall.txt | 4 ++--
src/main/resources/sling-scripting.txt | 7 ++-----
src/main/resources/sling-validation.txt | 7 ++-----
src/main/resources/sling-xss.txt | 4 ++--
36 files changed, 72 insertions(+), 57 deletions(-)
create mode 100644 src/main/resources/org.apache.jackrabbit.oak.security.authorization.AuthorizationConfigurationImpl.config
create mode 100644 src/main/resources/org.apache.jackrabbit.oak.security.internal.SecurityProviderRegistration.config
create mode 100644 src/main/resources/org.apache.jackrabbit.oak.spi.security.authorization.principalbased.impl.FilterProviderImpl.config
create mode 100644 src/main/resources/org.apache.jackrabbit.oak.spi.security.authorization.principalbased.impl.PrincipalBasedAuthorizationConfiguration.config
create mode 100644 src/main/resources/org.apache.sling.jcr.repoinit.RepositoryInitializer~sling_jcr_jackrabbit_usermanager.config
create mode 100644 src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_jcr_jackrabbit_usermanager.config
create mode 100644 src/main/resources/sling-jcr-jackrabbit-usermanager.txt
[sling-org-apache-sling-karaf-configs] 01/04: SLING-9690 Configure
best-effort import behaviour for access control items
Posted by ol...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
olli pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-karaf-configs.git
commit 610eab8f85e95c0eea4f27babfc807fa7cd07668
Author: Oliver Lietz <ol...@apache.org>
AuthorDate: Thu Dec 3 10:33:45 2020 +0100
SLING-9690 Configure best-effort import behaviour for access control items
---
...bbit.oak.security.authorization.AuthorizationConfigurationImpl.config | 1 +
1 file changed, 1 insertion(+)
diff --git a/src/main/resources/org.apache.jackrabbit.oak.security.authorization.AuthorizationConfigurationImpl.config b/src/main/resources/org.apache.jackrabbit.oak.security.authorization.AuthorizationConfigurationImpl.config
new file mode 100644
index 0000000..3adc135
--- /dev/null
+++ b/src/main/resources/org.apache.jackrabbit.oak.security.authorization.AuthorizationConfigurationImpl.config
@@ -0,0 +1 @@
+importBehavior="besteffort"
[sling-org-apache-sling-karaf-configs] 03/04: SLING-9786 Use
pre-authentication for system users
Posted by ol...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
olli pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-karaf-configs.git
commit 508c32085546cc0d64ac90e95432100668eab4da
Author: Oliver Lietz <ol...@apache.org>
AuthorDate: Thu Dec 3 11:13:44 2020 +0100
SLING-9786 Use pre-authentication for system users
---
...pping.impl.ServiceUserMapperImpl.amended~sling_caconfig.config | 2 +-
...ermapping.impl.ServiceUserMapperImpl.amended~sling_clam.config | 4 ++--
...ping.impl.ServiceUserMapperImpl.amended~sling_discovery.config | 6 +++---
...rmapping.impl.ServiceUserMapperImpl.amended~sling_event.config | 4 ++--
...ermapping.impl.ServiceUserMapperImpl.amended~sling_i18n.config | 2 +-
....impl.ServiceUserMapperImpl.amended~sling_installer_jcr.config | 2 +-
...l.ServiceUserMapperImpl.amended~sling_jcr_contentloader.config | 2 +-
...g.impl.ServiceUserMapperImpl.amended~sling_jcr_resource.config | 4 ++--
...l.ServiceUserMapperImpl.amended~sling_resource_presence.config | 2 +-
...pl.ServiceUserMapperImpl.amended~sling_resourceresolver.config | 8 ++++----
...pping.impl.ServiceUserMapperImpl.amended~sling_rewriter.config | 2 +-
...ping.impl.ServiceUserMapperImpl.amended~sling_scripting.config | 2 +-
....impl.ServiceUserMapperImpl.amended~sling_scripting_htl.config | 2 +-
...ServiceUserMapperImpl.amended~sling_scripting_thymeleaf.config | 2 +-
...pping.impl.ServiceUserMapperImpl.amended~sling_servlets.config | 4 ++--
...ing.impl.ServiceUserMapperImpl.amended~sling_validation.config | 2 +-
...sermapping.impl.ServiceUserMapperImpl.amended~sling_xss.config | 2 +-
src/main/resources/sling-clam.txt | 4 ++--
src/main/resources/sling-discovery.txt | 7 +++----
src/main/resources/sling-event.txt | 4 ++--
src/main/resources/sling-i18n.txt | 4 ++--
src/main/resources/sling-installer-jcr.txt | 4 ++--
src/main/resources/sling-jcr-contentloader.txt | 4 ++--
src/main/resources/sling-mapping.txt | 4 ++--
src/main/resources/sling-readall.txt | 4 ++--
src/main/resources/sling-scripting.txt | 7 ++-----
src/main/resources/sling-validation.txt | 7 ++-----
src/main/resources/sling-xss.txt | 4 ++--
28 files changed, 49 insertions(+), 56 deletions(-)
diff --git a/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_caconfig.config b/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_caconfig.config
index a38b9fc..3f79f89 100644
--- a/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_caconfig.config
+++ b/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_caconfig.config
@@ -1,3 +1,3 @@
user.mapping=[\
- "org.apache.sling.caconfig.impl\=sling-readall"\
+ "org.apache.sling.caconfig.impl\=[sling-readall]"\
]
diff --git a/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_clam.config b/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_clam.config
index 2685c0d..51f505c 100644
--- a/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_clam.config
+++ b/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_clam.config
@@ -1,4 +1,4 @@
user.mapping=[\
- "org.apache.sling.clam\=sling-clam",\
- "org.apache.sling.clam:result-writer\=sling-clam"\
+ "org.apache.sling.clam\=[sling-clam]",\
+ "org.apache.sling.clam:result-writer\=[sling-clam]"\
]
diff --git a/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_discovery.config b/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_discovery.config
index 076fc1f..a04b491 100644
--- a/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_discovery.config
+++ b/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_discovery.config
@@ -1,5 +1,5 @@
user.mapping=[\
- "org.apache.sling.discovery.commons\=sling-discovery",\
- "org.apache.sling.discovery.base\=sling-discovery",\
- "org.apache.sling.discovery.oak\=sling-discovery"\
+ "org.apache.sling.discovery.commons\=[sling-discovery]",\
+ "org.apache.sling.discovery.base\=[sling-discovery]",\
+ "org.apache.sling.discovery.oak\=[sling-discovery]"\
]
diff --git a/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_event.config b/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_event.config
index ebeda2e..fafe578 100644
--- a/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_event.config
+++ b/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_event.config
@@ -1,4 +1,4 @@
user.mapping=[\
- "org.apache.sling.event\=sling-event",\
- "org.apache.sling.event.dea\=sling-event"\
+ "org.apache.sling.event\=[sling-event]",\
+ "org.apache.sling.event.dea\=[sling-event]"\
]
diff --git a/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_i18n.config b/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_i18n.config
index be23cff..1cef8c0 100644
--- a/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_i18n.config
+++ b/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_i18n.config
@@ -1,3 +1,3 @@
user.mapping=[\
- "org.apache.sling.i18n\=sling-i18n"\
+ "org.apache.sling.i18n\=[sling-i18n]"\
]
diff --git a/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_installer_jcr.config b/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_installer_jcr.config
index b3055d4..e6416b7 100644
--- a/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_installer_jcr.config
+++ b/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_installer_jcr.config
@@ -1,3 +1,3 @@
user.mapping=[\
- "org.apache.sling.installer.provider.jcr\=sling-installer-jcr"\
+ "org.apache.sling.installer.provider.jcr\=[sling-installer-jcr]"\
]
diff --git a/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_jcr_contentloader.config b/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_jcr_contentloader.config
index 242a857..b03c2f0 100644
--- a/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_jcr_contentloader.config
+++ b/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_jcr_contentloader.config
@@ -1,3 +1,3 @@
user.mapping=[\
- "org.apache.sling.jcr.contentloader\=sling-jcr-contentloader"\
+ "org.apache.sling.jcr.contentloader\=[sling-jcr-contentloader]"\
]
diff --git a/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_jcr_resource.config b/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_jcr_resource.config
index 6661435..f4bfb2c 100644
--- a/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_jcr_resource.config
+++ b/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_jcr_resource.config
@@ -1,4 +1,4 @@
user.mapping=[\
- "org.apache.sling.jcr.resource:observation\=sling-readall",\
- "org.apache.sling.jcr.resource:validation\=sling-readall"\
+ "org.apache.sling.jcr.resource:observation\=[sling-readall]",\
+ "org.apache.sling.jcr.resource:validation\=[sling-readall]"\
]
diff --git a/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_resource_presence.config b/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_resource_presence.config
index fd25105..13f5344 100644
--- a/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_resource_presence.config
+++ b/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_resource_presence.config
@@ -1,3 +1,3 @@
user.mapping=[\
- "org.apache.sling.resource.presence\=sling-readall"\
+ "org.apache.sling.resource.presence\=[sling-readall]"\
]
diff --git a/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_resourceresolver.config b/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_resourceresolver.config
index 053cb29..b116cf6 100644
--- a/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_resourceresolver.config
+++ b/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_resourceresolver.config
@@ -1,6 +1,6 @@
user.mapping=[\
- "org.apache.sling.resourceresolver:mapping\=sling-mapping",\
- "org.apache.sling.resourceresolver:hierarchy\=sling-readall",\
- "org.apache.sling.resourceresolver:observation\=sling-readall",\
- "org.apache.sling.resourceresolver:console\=sling-readall"\
+ "org.apache.sling.resourceresolver:mapping\=[sling-mapping]",\
+ "org.apache.sling.resourceresolver:hierarchy\=[sling-readall]",\
+ "org.apache.sling.resourceresolver:observation\=[sling-readall]",\
+ "org.apache.sling.resourceresolver:console\=[sling-readall]"\
]
diff --git a/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_rewriter.config b/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_rewriter.config
index fd18caa..6d05b9e 100644
--- a/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_rewriter.config
+++ b/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_rewriter.config
@@ -1,3 +1,3 @@
user.mapping=[\
- "org.apache.sling.rewriter\=sling-readall"\
+ "org.apache.sling.rewriter\=[sling-readall]"\
]
diff --git a/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_scripting.config b/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_scripting.config
index 7654b49..93624b8 100644
--- a/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_scripting.config
+++ b/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_scripting.config
@@ -1,3 +1,3 @@
user.mapping=[\
- "org.apache.sling.scripting.core\=sling-scripting"\
+ "org.apache.sling.scripting.core\=[sling-scripting]"\
]
diff --git a/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_scripting_htl.config b/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_scripting_htl.config
index be235a8..2baa1ef 100644
--- a/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_scripting_htl.config
+++ b/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_scripting_htl.config
@@ -1,3 +1,3 @@
user.mapping=[\
- "org.apache.sling.scripting.sightly.js.provider\=sling-scripting"\
+ "org.apache.sling.scripting.sightly.js.provider\=[sling-scripting]"\
]
diff --git a/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_scripting_thymeleaf.config b/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_scripting_thymeleaf.config
index 9ff93ff..78a3826 100644
--- a/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_scripting_thymeleaf.config
+++ b/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_scripting_thymeleaf.config
@@ -1,3 +1,3 @@
user.mapping=[\
- "org.apache.sling.scripting.thymeleaf\=sling-scripting"\
+ "org.apache.sling.scripting.thymeleaf\=[sling-scripting]"\
]
diff --git a/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_servlets.config b/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_servlets.config
index 2290301..3630253 100644
--- a/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_servlets.config
+++ b/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_servlets.config
@@ -1,4 +1,4 @@
user.mapping=[\
- "org.apache.sling.servlets.resolver:console\=sling-readall",\
- "org.apache.sling.servlets.resolver:scripts\=sling-scripting"\
+ "org.apache.sling.servlets.resolver:console\=[sling-readall]",\
+ "org.apache.sling.servlets.resolver:scripts\=[sling-scripting]"\
]
diff --git a/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_validation.config b/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_validation.config
index a392f8b..43463dc 100644
--- a/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_validation.config
+++ b/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_validation.config
@@ -1,3 +1,3 @@
user.mapping=[\
- "org.apache.sling.validation.core\=sling-validation"\
+ "org.apache.sling.validation.core\=[sling-validation]"\
]
diff --git a/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_xss.config b/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_xss.config
index 0131c0f..151c013 100644
--- a/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_xss.config
+++ b/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_xss.config
@@ -1,3 +1,3 @@
user.mapping=[\
- "org.apache.sling.xss\=sling-xss"\
+ "org.apache.sling.xss\=[sling-xss]"\
]
diff --git a/src/main/resources/sling-clam.txt b/src/main/resources/sling-clam.txt
index 4561317..c0def2a 100644
--- a/src/main/resources/sling-clam.txt
+++ b/src/main/resources/sling-clam.txt
@@ -1,8 +1,8 @@
-create service user sling-clam
+create service user sling-clam with path system/sling
create path (sling:Folder) /var/clam/results(sling:OrderedFolder)
-set ACL for sling-clam
+set principal ACL for sling-clam
allow jcr:read on /
allow rep:write on /var/clam
end
diff --git a/src/main/resources/sling-discovery.txt b/src/main/resources/sling-discovery.txt
index cf086b4..6c12d58 100644
--- a/src/main/resources/sling-discovery.txt
+++ b/src/main/resources/sling-discovery.txt
@@ -1,9 +1,8 @@
-create service user sling-discovery
+create service user sling-discovery with path system/sling
create path (sling:Folder) /var/discovery
create path (sling:Folder) /var/discovery/oak
-set ACL for sling-discovery
- allow jcr:read on /var/discovery
- allow rep:write on /var/discovery
+set principal ACL for sling-discovery
+ allow jcr:read,rep:write on /var/discovery
end
diff --git a/src/main/resources/sling-event.txt b/src/main/resources/sling-event.txt
index efe2b30..39a6fd5 100644
--- a/src/main/resources/sling-event.txt
+++ b/src/main/resources/sling-event.txt
@@ -1,7 +1,7 @@
-create service user sling-event
+create service user sling-event with path system/sling
create path (sling:Folder) /var/eventing
-set ACL for sling-event
+set principal ACL for sling-event
allow jcr:all on /var/eventing
end
diff --git a/src/main/resources/sling-i18n.txt b/src/main/resources/sling-i18n.txt
index 81112af..3d04dc6 100644
--- a/src/main/resources/sling-i18n.txt
+++ b/src/main/resources/sling-i18n.txt
@@ -1,5 +1,5 @@
-create service user sling-i18n
+create service user sling-i18n with path system/sling
-set ACL for sling-i18n
+set principal ACL for sling-i18n
allow jcr:read on /
end
diff --git a/src/main/resources/sling-installer-jcr.txt b/src/main/resources/sling-installer-jcr.txt
index 39758b6..306203a 100644
--- a/src/main/resources/sling-installer-jcr.txt
+++ b/src/main/resources/sling-installer-jcr.txt
@@ -1,8 +1,8 @@
-create service user sling-installer-jcr
+create service user sling-installer-jcr with path system/sling
create path (sling:Folder) /apps/sling/install
-set ACL for sling-installer-jcr
+set principal ACL for sling-installer-jcr
allow jcr:read on /
allow rep:write on /apps/sling/install
end
diff --git a/src/main/resources/sling-jcr-contentloader.txt b/src/main/resources/sling-jcr-contentloader.txt
index ba2dd17..f7b11d0 100644
--- a/src/main/resources/sling-jcr-contentloader.txt
+++ b/src/main/resources/sling-jcr-contentloader.txt
@@ -1,5 +1,5 @@
-create service user sling-jcr-contentloader
+create service user sling-jcr-contentloader with path system/sling
-set ACL for sling-jcr-contentloader
+set principal ACL for sling-jcr-contentloader
allow jcr:all on /
end
diff --git a/src/main/resources/sling-mapping.txt b/src/main/resources/sling-mapping.txt
index d17ca13..6cf2c1c 100644
--- a/src/main/resources/sling-mapping.txt
+++ b/src/main/resources/sling-mapping.txt
@@ -1,5 +1,5 @@
-create service user sling-mapping
+create service user sling-mapping with path system/sling
-set ACL for sling-mapping
+set principal ACL for sling-mapping
allow jcr:read on /
end
diff --git a/src/main/resources/sling-readall.txt b/src/main/resources/sling-readall.txt
index 13cd474..e6f2925 100644
--- a/src/main/resources/sling-readall.txt
+++ b/src/main/resources/sling-readall.txt
@@ -1,5 +1,5 @@
-create service user sling-readall
+create service user sling-readall with path system/sling
-set ACL for sling-readall
+set principal ACL for sling-readall
allow jcr:read on /
end
diff --git a/src/main/resources/sling-scripting.txt b/src/main/resources/sling-scripting.txt
index 014bdf9..f0141a2 100644
--- a/src/main/resources/sling-scripting.txt
+++ b/src/main/resources/sling-scripting.txt
@@ -1,9 +1,6 @@
-create service user sling-scripting
+create service user sling-scripting with path system/sling
-create path (sling:Folder) /apps
-create path (sling:Folder) /libs
-
-set ACL for sling-scripting
+set principal ACL for sling-scripting
allow jcr:read on /apps
allow jcr:read on /libs
end
diff --git a/src/main/resources/sling-validation.txt b/src/main/resources/sling-validation.txt
index 9faa1d6..a4f25f5 100644
--- a/src/main/resources/sling-validation.txt
+++ b/src/main/resources/sling-validation.txt
@@ -1,9 +1,6 @@
-create service user sling-validation
+create service user sling-validation with path system/sling
-create path (sling:Folder) /apps
-create path (sling:Folder) /libs
-
-set ACL for sling-validation
+set principal ACL for sling-validation
allow jcr:read on /apps
allow jcr:read on /libs
end
diff --git a/src/main/resources/sling-xss.txt b/src/main/resources/sling-xss.txt
index 1d79114..945e0b9 100644
--- a/src/main/resources/sling-xss.txt
+++ b/src/main/resources/sling-xss.txt
@@ -1,9 +1,9 @@
-create service user sling-xss
+create service user sling-xss with path system/sling
create path (sling:Folder) /apps/sling/xss
create path (sling:Folder) /libs/sling/xss
-set ACL for sling-xss
+set principal ACL for sling-xss
allow jcr:read on /apps/sling/xss
allow jcr:read on /libs/sling/xss
end
[sling-org-apache-sling-karaf-configs] 04/04: add configs for
usermanager and adjust whitelist
Posted by ol...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
olli pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-karaf-configs.git
commit 2a6008ee8c77f5e663dec26c474b98d5b0bd37cf
Author: Oliver Lietz <ol...@apache.org>
AuthorDate: Thu Dec 3 11:15:52 2020 +0100
add configs for usermanager and adjust whitelist
---
...g.jcr.base.internal.LoginAdminWhitelist.fragment~sling_jcr.config | 1 -
...nit.RepositoryInitializer~sling_jcr_jackrabbit_usermanager.config | 3 +++
...iceUserMapperImpl.amended~sling_jcr_jackrabbit_usermanager.config | 3 +++
src/main/resources/sling-jcr-jackrabbit-usermanager.txt | 5 +++++
4 files changed, 11 insertions(+), 1 deletion(-)
diff --git a/src/main/resources/org.apache.sling.jcr.base.internal.LoginAdminWhitelist.fragment~sling_jcr.config b/src/main/resources/org.apache.sling.jcr.base.internal.LoginAdminWhitelist.fragment~sling_jcr.config
index a2f0ae2..8636855 100644
--- a/src/main/resources/org.apache.sling.jcr.base.internal.LoginAdminWhitelist.fragment~sling_jcr.config
+++ b/src/main/resources/org.apache.sling.jcr.base.internal.LoginAdminWhitelist.fragment~sling_jcr.config
@@ -2,7 +2,6 @@ whitelist.name="sling-jcr"
whitelist.bundles=[\
"org.apache.sling.jcr.base",\
"org.apache.sling.jcr.classloader",\
- "org.apache.sling.jcr.jackrabbit.usermanager",\
"org.apache.sling.jcr.oak.server",\
"org.apache.sling.jcr.repoinit",\
"org.apache.sling.jcr.webconsole"\
diff --git a/src/main/resources/org.apache.sling.jcr.repoinit.RepositoryInitializer~sling_jcr_jackrabbit_usermanager.config b/src/main/resources/org.apache.sling.jcr.repoinit.RepositoryInitializer~sling_jcr_jackrabbit_usermanager.config
new file mode 100644
index 0000000..cd2d1a9
--- /dev/null
+++ b/src/main/resources/org.apache.sling.jcr.repoinit.RepositoryInitializer~sling_jcr_jackrabbit_usermanager.config
@@ -0,0 +1,3 @@
+references=[\
+ "classpath:sling-jcr-jackrabbit-usermanager.txt"\
+]
diff --git a/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_jcr_jackrabbit_usermanager.config b/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_jcr_jackrabbit_usermanager.config
new file mode 100644
index 0000000..5899bc6
--- /dev/null
+++ b/src/main/resources/org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~sling_jcr_jackrabbit_usermanager.config
@@ -0,0 +1,3 @@
+user.mapping=[\
+ "org.apache.sling.jcr.jackrabbit.usermanager\=[sling-jcr-jackrabbit-usermanager]"\
+]
diff --git a/src/main/resources/sling-jcr-jackrabbit-usermanager.txt b/src/main/resources/sling-jcr-jackrabbit-usermanager.txt
new file mode 100644
index 0000000..1893092
--- /dev/null
+++ b/src/main/resources/sling-jcr-jackrabbit-usermanager.txt
@@ -0,0 +1,5 @@
+create service user sling-jcr-jackrabbit-usermanager with path system/sling
+
+set principal ACL for sling-jcr-jackrabbit-usermanager
+ allow jcr:read,jcr:readAccessControl,jcr:modifyAccessControl,rep:write,rep:userManagement on /home
+end
[sling-org-apache-sling-karaf-configs] 02/04: SLING-9685 Support
principal-based authentication
Posted by ol...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
olli pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-karaf-configs.git
commit 6db91b230283b34cdd1501de5f1fcc61aa8ac94e
Author: Oliver Lietz <ol...@apache.org>
AuthorDate: Thu Dec 3 10:39:28 2020 +0100
SLING-9685 Support principal-based authentication
---
...bit.oak.security.internal.SecurityProviderRegistration.config | 9 +++++++++
...y.authorization.principalbased.impl.FilterProviderImpl.config | 1 +
...palbased.impl.PrincipalBasedAuthorizationConfiguration.config | 1 +
3 files changed, 11 insertions(+)
diff --git a/src/main/resources/org.apache.jackrabbit.oak.security.internal.SecurityProviderRegistration.config b/src/main/resources/org.apache.jackrabbit.oak.security.internal.SecurityProviderRegistration.config
new file mode 100644
index 0000000..9c7656c
--- /dev/null
+++ b/src/main/resources/org.apache.jackrabbit.oak.security.internal.SecurityProviderRegistration.config
@@ -0,0 +1,9 @@
+requiredServicePids":[\
+ "org.apache.jackrabbit.oak.security.authorization.AuthorizationConfigurationImpl",\
+ "org.apache.jackrabbit.oak.security.principal.PrincipalConfigurationImpl",\
+ "org.apache.jackrabbit.oak.security.authentication.token.TokenConfigurationImpl",\
+ "org.apache.jackrabbit.oak.spi.security.user.action.DefaultAuthorizableActionProvider",\
+ "org.apache.jackrabbit.oak.security.authorization.restriction.RestrictionProviderImpl",\
+ "org.apache.jackrabbit.oak.security.user.UserAuthenticationFactoryImpl",\
+ "org.apache.jackrabbit.oak.spi.security.authorization.principalbased.impl.PrincipalBasedAuthorizationConfiguration"\
+]
diff --git a/src/main/resources/org.apache.jackrabbit.oak.spi.security.authorization.principalbased.impl.FilterProviderImpl.config b/src/main/resources/org.apache.jackrabbit.oak.spi.security.authorization.principalbased.impl.FilterProviderImpl.config
new file mode 100644
index 0000000..cbd680c
--- /dev/null
+++ b/src/main/resources/org.apache.jackrabbit.oak.spi.security.authorization.principalbased.impl.FilterProviderImpl.config
@@ -0,0 +1 @@
+path="/home/users/system/sling"
diff --git a/src/main/resources/org.apache.jackrabbit.oak.spi.security.authorization.principalbased.impl.PrincipalBasedAuthorizationConfiguration.config b/src/main/resources/org.apache.jackrabbit.oak.spi.security.authorization.principalbased.impl.PrincipalBasedAuthorizationConfiguration.config
new file mode 100644
index 0000000..2837271
--- /dev/null
+++ b/src/main/resources/org.apache.jackrabbit.oak.spi.security.authorization.principalbased.impl.PrincipalBasedAuthorizationConfiguration.config
@@ -0,0 +1 @@
+enableAggregationFilter=B"true"