Private content in JCR

[Branden Visser <br...@uwindsor.ca>]

 Hi all,

This sounds like more of a JCR question then Sling, but I'm hoping it's a quick answer:

If I have a resource node: /users/branden, how would I make the resource 'branden' and everything beneath it be private, so that no other authenticated user (except branden) can read it? I looked at the AccessControl spec and read up on the spec, but I didn't see anything that could serve this purpose. Did I miss a document?

Thanks,
Branden
 

Re: Private content in JCR

[Felix Meschberger <fm...@gmail.com>]

Hi,

I am working on the JCR2/Jackrabbit 2 integration in my whiteboard at [1]

Regards
Felix

[1]
https://svn.apache.org/repos/asf/sling/whiteboard/fmeschbe/jackrabbit2upgrade/

Branden Visser schrieb:
>  Ian,
> 
> Thanks for the detailed reply. I've left some comments below.
>  
> -----Ian Boston <ia...@googlemail.com> wrote: -----
> 
>> To:&nbsp;dev@sling.apache.org
>> From:&nbsp;Ian&nbsp;Boston&nbsp;<ie...@tfd.co.uk>
>> Sent&nbsp;by:&nbsp;Ian&nbsp;Boston&nbsp;<ia...@googlemail.com>
>> Date:&nbsp;12/05/2009&nbsp;07:42AM
>> Cc:&nbsp;sling-dev@apache.org
>> Subject:&nbsp;Re:&nbsp;Private&nbsp;content&nbsp;in&nbsp;JCR
>>
>> Branden,
>> Depending&nbsp;on&nbsp;which&nbsp;version&nbsp;of&nbsp;Jackrabbit&nbsp;you&nbsp;are&nbsp;running&nbsp;you&nbsp;might&nbsp;be
>> &nbsp;
>> able&nbsp;to.
>>
>> Assuming
>> /&nbsp;has
>> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;everyone:grant:jcr:write
>> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;admin:grant:jcr:all
>> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;anonomous:grant:jcr:read
>> then&nbsp;/users/branden&nbsp;will&nbsp;need
>> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;branden:grant:jcr:write
>> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;everyone:deny:jcr:all
>> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;anonomous:deny:jcr:all
>>
> 
> Ahh, an "everyone" group, that's one big concept I was missing (as well as info about the group deny). Is this a built-in group in JCR that I can reference? Or do I have to create and maintain it manually as I create more users?
> 
>> Certainly&nbsp;in&nbsp;1.5.7&nbsp;you&nbsp;cant&nbsp;deny&nbsp;access&nbsp;to&nbsp;a&nbsp;group,
>> so&nbsp;since&nbsp;everyone&nbsp;was&nbsp;granted&nbsp;read&nbsp;at&nbsp;/&nbsp;you&nbsp;cant&nbsp;deny&nbsp;read&nbsp;at&nbsp;/users/
>>
>> branden
>>
>> I&nbsp;think&nbsp;in&nbsp;JR2&nbsp;group&nbsp;deny&nbsp;was&nbsp;enabled,&nbsp;but&nbsp;ATM&nbsp;we&nbsp;dont&nbsp;have&nbsp;JR2&nbsp;in&nbsp;&nbsp;
>> Sling&nbsp;(Felix&nbsp;is&nbsp;working&nbsp;on&nbsp;it).
>>
> 
> Is there a JIRA ticket I can track for the progress? Or even better, some incomplete prerequisite tickets I can complete to help the process along?
> 
>> The&nbsp;other&nbsp;problem&nbsp;is&nbsp;that&nbsp;both&nbsp;the&nbsp;AccessManagerServlets&nbsp;and&nbsp;the&nbsp;&nbsp;
>> DefaultSecurityManager&nbsp;have&nbsp;blocks&nbsp;of&nbsp;code&nbsp;that&nbsp;prevent&nbsp;a&nbsp;&nbsp;
>> group:deny:*&nbsp;&nbsp;ACE&nbsp;being&nbsp;applied.
>>
>> ie&nbsp;you&nbsp;cant&nbsp;set&nbsp;everyone:deny:jcr:all&nbsp;and&nbsp;its&nbsp;not&nbsp;processed&nbsp;even&nbsp;if&nbsp;&nbsp;
>> you&nbsp;could.
>>
>> So&nbsp;as&nbsp;part&nbsp;of&nbsp;the&nbsp;upgrade&nbsp;to&nbsp;2,&nbsp;the&nbsp;checks&nbsp;would&nbsp;need&nbsp;to&nbsp;be&nbsp;removed
>> in&nbsp;&nbsp;
>> the&nbsp;access&nbsp;manager&nbsp;bundle&nbsp;to&nbsp;allow&nbsp;group&nbsp;deny.
>> Alternatively&nbsp;I&nbsp;think&nbsp;the&nbsp;security&nbsp;settings&nbsp;in&nbsp;the&nbsp;contentloader&nbsp;&nbsp;
>> bundle&nbsp;will&nbsp;allow&nbsp;you&nbsp;to&nbsp;set&nbsp;these&nbsp;ACE's&nbsp;directly
>>
>> ----------------
>>
>> We&nbsp;had&nbsp;exactly&nbsp;the&nbsp;same&nbsp;issue,&nbsp;so&nbsp;we&nbsp;patched&nbsp;everything&nbsp;to&nbsp;make&nbsp;it&nbsp;&nbsp;
>> work.&nbsp;Sady&nbsp;the&nbsp;patch&nbsp;to&nbsp;the&nbsp;1.5.7&nbsp;DefaultSecurityManager&nbsp;is&nbsp;quite&nbsp;&nbsp;
>> extensive&nbsp;since&nbsp;it&nbsp;requires&nbsp;far&nbsp;greater&nbsp;control&nbsp;over&nbsp;the&nbsp;order&nbsp;in&nbsp;&nbsp;
>> which&nbsp;the&nbsp;ACL&nbsp;bitmap&nbsp;is&nbsp;compiled.&nbsp;(branded&nbsp;is&nbsp;a&nbsp;member&nbsp;of&nbsp;everyone&nbsp;is
>> &nbsp;
>> just&nbsp;one&nbsp;issue)
>>
>> I&nbsp;am&nbsp;in&nbsp;the&nbsp;process&nbsp;or&nbsp;reworking&nbsp;those&nbsp;patches&nbsp;for&nbsp;the&nbsp;JR1.6&nbsp;based&nbsp;&nbsp;
>> server&nbsp;bundle,&nbsp;but&nbsp;I&nbsp;am&nbsp;not&nbsp;there&nbsp;yet,&nbsp;and&nbsp;can&nbsp;give&nbsp;you&nbsp;pointers&nbsp;to&nbsp;&nbsp;
>> the&nbsp;code&nbsp;if&nbsp;you&nbsp;like.
> 
> If you don't mind giving pointers to the code, that would be great. Depending on the timeline of Sling+JR2, I wouldn't mind looking at group-deny for 1.6 if there are any open JIRA's associated to it.
> 
>> HTH
>> Ian
>>
> 
> Thanks again, it was a great help.
> 
> Branden
> 
>> On&nbsp;5&nbsp;Dec&nbsp;2009,&nbsp;at&nbsp;01:30,&nbsp;Branden&nbsp;Visser&nbsp;wrote:
>>
>>> &nbsp;Hi&nbsp;all,
>>>
>>> &nbsp;This&nbsp;sounds&nbsp;like&nbsp;more&nbsp;of&nbsp;a&nbsp;JCR&nbsp;question&nbsp;then&nbsp;Sling,&nbsp;but&nbsp;I'm&nbsp;hoping&nbsp;
>>> &nbsp;it's&nbsp;a&nbsp;quick&nbsp;answer:
>>>
>>> &nbsp;If&nbsp;I&nbsp;have&nbsp;a&nbsp;resource&nbsp;node:&nbsp;/users/branden,&nbsp;how&nbsp;would&nbsp;I&nbsp;make&nbsp;the&nbsp;&nbsp;
>>> &nbsp;resource&nbsp;'branden'&nbsp;and&nbsp;everything&nbsp;beneath&nbsp;it&nbsp;be&nbsp;private,&nbsp;so&nbsp;that&nbsp;no
>> &nbsp;
>>> &nbsp;other&nbsp;authenticated&nbsp;user&nbsp;(except&nbsp;branden)&nbsp;can&nbsp;read&nbsp;it?&nbsp;I&nbsp;looked&nbsp;at&nbsp;
>>> &nbsp;the&nbsp;AccessControl&nbsp;spec&nbsp;and&nbsp;read&nbsp;up&nbsp;on&nbsp;the&nbsp;spec,&nbsp;but&nbsp;I&nbsp;didn't&nbsp;see&nbsp;&nbsp;
>>> &nbsp;anything&nbsp;that&nbsp;could&nbsp;serve&nbsp;this&nbsp;purpose.&nbsp;Did&nbsp;I&nbsp;miss&nbsp;a&nbsp;document?
>>>
>>> &nbsp;Thanks,
>>> &nbsp;Branden
>>>
>>>
> 
> 

Re: Private content in JCR

[Ian Boston <ie...@tfd.co.uk>]

You might want to consider not using html on lists :), came through a  
bit odd.
  Comments inline

On 5 Dec 2009, at 15:39, Branden Visser wrote:

> Ian,
>
> Thanks for the detailed reply. I've left some comments below.
>
> -----Ian Boston <ia...@googlemail.com> wrote: -----
>
>> To:&nbsp;dev@sling.apache.org
>> From:&nbsp;Ian&nbsp;Boston&nbsp;<ie...@tfd.co.uk>
>> Sent&nbsp;by:&nbsp;Ian&nbsp;Boston&nbsp;<ia...@googlemail.com>
>> Date:&nbsp;12/05/2009&nbsp;07:42AM
>> Cc:&nbsp;sling-dev@apache.org
>> Subject:&nbsp;Re:&nbsp;Private&nbsp;content&nbsp;in&nbsp;JCR
>>
>> Branden,
>> Depending 
>> &nbsp 
>> ;on 
>> &nbsp 
>> ;which 
>> &nbsp 
>> ;version 
>> &nbsp 
>> ;of 
>> &nbsp 
>> ;Jackrabbit 
>> &nbsp;you&nbsp;are&nbsp;running&nbsp;you&nbsp;might&nbsp;be
>> &nbsp;
>> able&nbsp;to.
>>
>> Assuming
>> /&nbsp;has
>> &nbsp 
>> ;&nbsp 
>> ;&nbsp 
>> ;&nbsp 
>> ;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;everyone:grant:jcr:write
>> &nbsp 
>> ;&nbsp 
>> ;&nbsp 
>> ;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;admin:grant:jcr:all
>> &nbsp 
>> ;&nbsp 
>> ;&nbsp 
>> ;&nbsp 
>> ;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;anonomous:grant:jcr:read
>> then&nbsp;/users/branden&nbsp;will&nbsp;need
>> &nbsp 
>> ;&nbsp 
>> ;&nbsp 
>> ;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;branden:grant:jcr:write
>> &nbsp 
>> ;&nbsp 
>> ;&nbsp 
>> ;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;everyone:deny:jcr:all
>> &nbsp 
>> ;&nbsp 
>> ;&nbsp 
>> ;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;anonomous:deny:jcr:all
>>
>
> Ahh, an "everyone" group, that's one big concept I was missing (as  
> well as info about the group deny). Is this a built-in group in JCR  
> that I can reference?

Yes I think it is you should use the PrincipalManager.getEveryone()  
method to get its principal which you can use to reference it. I think  
it might be a bit unsafe to use "everyone" as a string.

> Or do I have to create and maintain it manually as I create more  
> users?

IIRC the PrincipalManager impl does it all auto for you.

>
>>
>> Certainly&nbsp;in&nbsp; 
>> 1.5.7 
>> &nbsp;you&nbsp;cant&nbsp;deny&nbsp;access&nbsp;to&nbsp;a&nbsp;group,
>> so 
>> &nbsp 
>> ;since&nbsp;everyone&nbsp;was&nbsp;granted&nbsp;read&nbsp;at&nbsp;/ 
>> &nbsp;you&nbsp;cant&nbsp;deny&nbsp;read&nbsp;at&nbsp;/users/
>>
>> branden
>>
>> I 
>> &nbsp 
>> ;think 
>> &nbsp 
>> ;in 
>> &nbsp 
>> ;JR2 
>> &nbsp 
>> ;group 
>> &nbsp 
>> ;deny 
>> &nbsp 
>> ;was 
>> &nbsp 
>> ;enabled 
>> ,&nbsp 
>> ;but 
>> &nbsp;ATM&nbsp;we&nbsp;dont&nbsp;have&nbsp;JR2&nbsp;in&nbsp;&nbsp;
>> Sling&nbsp;(Felix&nbsp;is&nbsp;working&nbsp;on&nbsp;it).
>>
>
> Is there a JIRA ticket I can track for the progress? Or even better,  
> some incomplete prerequisite tickets I can complete to help the  
> process along?

> https://issues.apache.org/jira/browse/SLING-1093



>
>> The 
>> &nbsp 
>> ;other 
>> &nbsp 
>> ;problem 
>> &nbsp 
>> ;is 
>> &nbsp 
>> ;that 
>> &nbsp 
>> ;both 
>> &nbsp;the&nbsp;AccessManagerServlets&nbsp;and&nbsp;the&nbsp;&nbsp;
>> DefaultSecurityManager 
>> &nbsp 
>> ;have 
>> &nbsp 
>> ;blocks&nbsp;of&nbsp;code&nbsp;that&nbsp;prevent&nbsp;a&nbsp;&nbsp;
>> group:deny:*&nbsp;&nbsp;ACE&nbsp;being&nbsp;applied.
>>
>> ie 
>> &nbsp 
>> ;you 
>> &nbsp 
>> ;cant 
>> &nbsp 
>> ;set 
>> &nbsp 
>> ;everyone:deny:jcr:all 
>> &nbsp 
>> ;and&nbsp;its&nbsp;not&nbsp;processed&nbsp;even&nbsp;if&nbsp;&nbsp;
>> you&nbsp;could.
>>
>> So&nbsp;as&nbsp;part&nbsp;of&nbsp;the&nbsp;upgrade&nbsp;to&nbsp; 
>> 2 
>> ,&nbsp 
>> ;the&nbsp;checks&nbsp;would&nbsp;need&nbsp;to&nbsp;be&nbsp;removed
>> in&nbsp;&nbsp;
>> the 
>> &nbsp 
>> ;access 
>> &nbsp;manager&nbsp;bundle&nbsp;to&nbsp;allow&nbsp;group&nbsp;deny.
>> Alternatively 
>> &nbsp 
>> ;I 
>> &nbsp 
>> ;think 
>> &nbsp 
>> ;the 
>> &nbsp 
>> ;security 
>> &nbsp;settings&nbsp;in&nbsp;the&nbsp;contentloader&nbsp;&nbsp;
>> bundle 
>> &nbsp 
>> ;will 
>> &nbsp 
>> ;allow&nbsp;you&nbsp;to&nbsp;set&nbsp;these&nbsp;ACE's&nbsp;directly
>>
>> ----------------
>>
>> We 
>> &nbsp 
>> ;had 
>> &nbsp 
>> ;exactly 
>> &nbsp 
>> ;the 
>> &nbsp 
>> ;same 
>> &nbsp 
>> ;issue 
>> ,&nbsp 
>> ;so 
>> &nbsp 
>> ;we 
>> &nbsp;patched&nbsp;everything&nbsp;to&nbsp;make&nbsp;it&nbsp;&nbsp;
>> work.&nbsp;Sady&nbsp;the&nbsp;patch&nbsp;to&nbsp;the&nbsp; 
>> 1.5.7&nbsp;DefaultSecurityManager&nbsp;is&nbsp;quite&nbsp;&nbsp;
>> extensive 
>> &nbsp 
>> ;since 
>> &nbsp 
>> ;it 
>> &nbsp 
>> ;requires 
>> &nbsp 
>> ;far 
>> &nbsp 
>> ;greater 
>> &nbsp;control&nbsp;over&nbsp;the&nbsp;order&nbsp;in&nbsp;&nbsp;
>> which&nbsp;the&nbsp;ACL&nbsp;bitmap&nbsp;is&nbsp;compiled.&nbsp; 
>> (branded&nbsp;is&nbsp;a&nbsp;member&nbsp;of&nbsp;everyone&nbsp;is
>> &nbsp;
>> just&nbsp;one&nbsp;issue)
>>
>> I 
>> &nbsp 
>> ;am 
>> &nbsp 
>> ;in 
>> &nbsp 
>> ;the 
>> &nbsp 
>> ;process 
>> &nbsp 
>> ;or 
>> &nbsp 
>> ;reworking 
>> &nbsp 
>> ;those 
>> &nbsp;patches&nbsp;for&nbsp;the&nbsp;JR1.6&nbsp;based&nbsp;&nbsp;
>> server 
>> &nbsp 
>> ;bundle 
>> ,&nbsp 
>> ;but 
>> &nbsp 
>> ;I 
>> &nbsp 
>> ;am 
>> &nbsp 
>> ;not 
>> &nbsp 
>> ;there 
>> &nbsp 
>> ;yet 
>> ,&nbsp 
>> ;and&nbsp;can&nbsp;give&nbsp;you&nbsp;pointers&nbsp;to&nbsp;&nbsp;
>> the&nbsp;code&nbsp;if&nbsp;you&nbsp;like.
>
> If you don't mind giving pointers to the code, that would be great.  
> Depending on the timeline of Sling+JR2, I wouldn't mind looking at  
> group-deny for 1.6 if there are any open JIRA's associated to it.



My server bundle is [1], access manager [2], user manager [3], however  
the user manager is highly custom (and you might not need it)

These are JR1.5.7 versions, and may include dependencies you dont want  
(esp user)

Ian

1. http://github.com/ieb/open-experiments/tree/master/slingtests/osgikernel/bundles/server/
2. http://github.com/ieb/open-experiments/tree/master/slingtests/osgikernel/bundles/sling/accessmanager/
3. http://github.com/ieb/open-experiments/tree/master/slingtests/osgikernel/bundles/user/


>
>> HTH
>> Ian
>>
>
> Thanks again, it was a great help.
>
> Branden
>
>> On&nbsp;5&nbsp;Dec&nbsp;2009,&nbsp;at&nbsp; 
>> 01:30,&nbsp;Branden&nbsp;Visser&nbsp;wrote:
>>
>>> &nbsp;Hi&nbsp;all,
>>>
>>> &nbsp 
>>> ;This 
>>> &nbsp 
>>> ;sounds 
>>> &nbsp 
>>> ;like 
>>> &nbsp 
>>> ;more 
>>> &nbsp 
>>> ;of 
>>> &nbsp 
>>> ;a 
>>> &nbsp 
>>> ;JCR 
>>> &nbsp 
>>> ;question&nbsp;then&nbsp;Sling,&nbsp;but&nbsp;I'm&nbsp;hoping&nbsp;
>>
>>> &nbsp;it's&nbsp;a&nbsp;quick&nbsp;answer:
>>>
>>> &nbsp;If&nbsp;I&nbsp;have&nbsp;a&nbsp;resource&nbsp;node:&nbsp;/ 
>>> users/ 
>>> branden,&nbsp;how&nbsp;would&nbsp;I&nbsp;make&nbsp;the&nbsp;&nbsp;
>>> &nbsp 
>>> ;resource 
>>> &nbsp 
>>> ;'branden 
>>> '&nbsp 
>>> ;and 
>>> &nbsp 
>>> ;everything 
>>> &nbsp 
>>> ;beneath&nbsp;it&nbsp;be&nbsp;private,&nbsp;so&nbsp;that&nbsp;no
>> &nbsp;
>>> &nbsp;other&nbsp;authenticated&nbsp;user&nbsp; 
>>> (except&nbsp;branden)&nbsp;can&nbsp;read&nbsp;it? 
>>> &nbsp;I&nbsp;looked&nbsp;at&nbsp;
>>
>>> &nbsp 
>>> ;the 
>>> &nbsp 
>>> ;AccessControl 
>>> &nbsp 
>>> ;spec 
>>> &nbsp 
>>> ;and 
>>> &nbsp 
>>> ;read 
>>> &nbsp 
>>> ;up 
>>> &nbsp 
>>> ;on 
>>> &nbsp 
>>> ;the&nbsp;spec,&nbsp;but&nbsp;I&nbsp;didn't&nbsp;see&nbsp;&nbsp;
>>> &nbsp 
>>> ;anything 
>>> &nbsp 
>>> ;that 
>>> &nbsp 
>>> ;could 
>>> &nbsp 
>>> ;serve 
>>> &nbsp 
>>> ;this&nbsp;purpose.&nbsp;Did&nbsp;I&nbsp;miss&nbsp;a&nbsp;document?
>>>
>>> &nbsp;Thanks,
>>> &nbsp;Branden
>>>
>>>
>

Re: Private content in JCR

[Branden Visser <br...@uwindsor.ca>]

 Ian,

Thanks for the detailed reply. I've left some comments below.
 
-----Ian Boston <ia...@googlemail.com> wrote: -----

>To:&nbsp;dev@sling.apache.org
>From:&nbsp;Ian&nbsp;Boston&nbsp;<ie...@tfd.co.uk>
>Sent&nbsp;by:&nbsp;Ian&nbsp;Boston&nbsp;<ia...@googlemail.com>
>Date:&nbsp;12/05/2009&nbsp;07:42AM
>Cc:&nbsp;sling-dev@apache.org
>Subject:&nbsp;Re:&nbsp;Private&nbsp;content&nbsp;in&nbsp;JCR
>
>Branden,
>Depending&nbsp;on&nbsp;which&nbsp;version&nbsp;of&nbsp;Jackrabbit&nbsp;you&nbsp;are&nbsp;running&nbsp;you&nbsp;might&nbsp;be
>&nbsp;
>able&nbsp;to.
>
>Assuming
>/&nbsp;has
>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;everyone:grant:jcr:write
>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;admin:grant:jcr:all
>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;anonomous:grant:jcr:read
>then&nbsp;/users/branden&nbsp;will&nbsp;need
>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;branden:grant:jcr:write
>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;everyone:deny:jcr:all
>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;anonomous:deny:jcr:all
>

Ahh, an "everyone" group, that's one big concept I was missing (as well as info about the group deny). Is this a built-in group in JCR that I can reference? Or do I have to create and maintain it manually as I create more users?

>
>Certainly&nbsp;in&nbsp;1.5.7&nbsp;you&nbsp;cant&nbsp;deny&nbsp;access&nbsp;to&nbsp;a&nbsp;group,
>so&nbsp;since&nbsp;everyone&nbsp;was&nbsp;granted&nbsp;read&nbsp;at&nbsp;/&nbsp;you&nbsp;cant&nbsp;deny&nbsp;read&nbsp;at&nbsp;/users/
>
>branden
>
>I&nbsp;think&nbsp;in&nbsp;JR2&nbsp;group&nbsp;deny&nbsp;was&nbsp;enabled,&nbsp;but&nbsp;ATM&nbsp;we&nbsp;dont&nbsp;have&nbsp;JR2&nbsp;in&nbsp;&nbsp;
>Sling&nbsp;(Felix&nbsp;is&nbsp;working&nbsp;on&nbsp;it).
>

Is there a JIRA ticket I can track for the progress? Or even better, some incomplete prerequisite tickets I can complete to help the process along?

>The&nbsp;other&nbsp;problem&nbsp;is&nbsp;that&nbsp;both&nbsp;the&nbsp;AccessManagerServlets&nbsp;and&nbsp;the&nbsp;&nbsp;
>DefaultSecurityManager&nbsp;have&nbsp;blocks&nbsp;of&nbsp;code&nbsp;that&nbsp;prevent&nbsp;a&nbsp;&nbsp;
>group:deny:*&nbsp;&nbsp;ACE&nbsp;being&nbsp;applied.
>
>ie&nbsp;you&nbsp;cant&nbsp;set&nbsp;everyone:deny:jcr:all&nbsp;and&nbsp;its&nbsp;not&nbsp;processed&nbsp;even&nbsp;if&nbsp;&nbsp;
>you&nbsp;could.
>
>So&nbsp;as&nbsp;part&nbsp;of&nbsp;the&nbsp;upgrade&nbsp;to&nbsp;2,&nbsp;the&nbsp;checks&nbsp;would&nbsp;need&nbsp;to&nbsp;be&nbsp;removed
>in&nbsp;&nbsp;
>the&nbsp;access&nbsp;manager&nbsp;bundle&nbsp;to&nbsp;allow&nbsp;group&nbsp;deny.
>Alternatively&nbsp;I&nbsp;think&nbsp;the&nbsp;security&nbsp;settings&nbsp;in&nbsp;the&nbsp;contentloader&nbsp;&nbsp;
>bundle&nbsp;will&nbsp;allow&nbsp;you&nbsp;to&nbsp;set&nbsp;these&nbsp;ACE's&nbsp;directly
>
>----------------
>
>We&nbsp;had&nbsp;exactly&nbsp;the&nbsp;same&nbsp;issue,&nbsp;so&nbsp;we&nbsp;patched&nbsp;everything&nbsp;to&nbsp;make&nbsp;it&nbsp;&nbsp;
>work.&nbsp;Sady&nbsp;the&nbsp;patch&nbsp;to&nbsp;the&nbsp;1.5.7&nbsp;DefaultSecurityManager&nbsp;is&nbsp;quite&nbsp;&nbsp;
>extensive&nbsp;since&nbsp;it&nbsp;requires&nbsp;far&nbsp;greater&nbsp;control&nbsp;over&nbsp;the&nbsp;order&nbsp;in&nbsp;&nbsp;
>which&nbsp;the&nbsp;ACL&nbsp;bitmap&nbsp;is&nbsp;compiled.&nbsp;(branded&nbsp;is&nbsp;a&nbsp;member&nbsp;of&nbsp;everyone&nbsp;is
>&nbsp;
>just&nbsp;one&nbsp;issue)
>
>I&nbsp;am&nbsp;in&nbsp;the&nbsp;process&nbsp;or&nbsp;reworking&nbsp;those&nbsp;patches&nbsp;for&nbsp;the&nbsp;JR1.6&nbsp;based&nbsp;&nbsp;
>server&nbsp;bundle,&nbsp;but&nbsp;I&nbsp;am&nbsp;not&nbsp;there&nbsp;yet,&nbsp;and&nbsp;can&nbsp;give&nbsp;you&nbsp;pointers&nbsp;to&nbsp;&nbsp;
>the&nbsp;code&nbsp;if&nbsp;you&nbsp;like.

If you don't mind giving pointers to the code, that would be great. Depending on the timeline of Sling+JR2, I wouldn't mind looking at group-deny for 1.6 if there are any open JIRA's associated to it.

>HTH
>Ian
>

Thanks again, it was a great help.

Branden

>On&nbsp;5&nbsp;Dec&nbsp;2009,&nbsp;at&nbsp;01:30,&nbsp;Branden&nbsp;Visser&nbsp;wrote:
>
>>&nbsp;Hi&nbsp;all,
>>
>>&nbsp;This&nbsp;sounds&nbsp;like&nbsp;more&nbsp;of&nbsp;a&nbsp;JCR&nbsp;question&nbsp;then&nbsp;Sling,&nbsp;but&nbsp;I'm&nbsp;hoping&nbsp;
>
>>&nbsp;it's&nbsp;a&nbsp;quick&nbsp;answer:
>>
>>&nbsp;If&nbsp;I&nbsp;have&nbsp;a&nbsp;resource&nbsp;node:&nbsp;/users/branden,&nbsp;how&nbsp;would&nbsp;I&nbsp;make&nbsp;the&nbsp;&nbsp;
>>&nbsp;resource&nbsp;'branden'&nbsp;and&nbsp;everything&nbsp;beneath&nbsp;it&nbsp;be&nbsp;private,&nbsp;so&nbsp;that&nbsp;no
>&nbsp;
>>&nbsp;other&nbsp;authenticated&nbsp;user&nbsp;(except&nbsp;branden)&nbsp;can&nbsp;read&nbsp;it?&nbsp;I&nbsp;looked&nbsp;at&nbsp;
>
>>&nbsp;the&nbsp;AccessControl&nbsp;spec&nbsp;and&nbsp;read&nbsp;up&nbsp;on&nbsp;the&nbsp;spec,&nbsp;but&nbsp;I&nbsp;didn't&nbsp;see&nbsp;&nbsp;
>>&nbsp;anything&nbsp;that&nbsp;could&nbsp;serve&nbsp;this&nbsp;purpose.&nbsp;Did&nbsp;I&nbsp;miss&nbsp;a&nbsp;document?
>>
>>&nbsp;Thanks,
>>&nbsp;Branden
>>
>>

Re: Private content in JCR

[Ian Boston <ie...@tfd.co.uk>]

Branden,
Depending on which version of Jackrabbit you are running you might be  
able to.

Assuming
/ has
           everyone:grant:jcr:write
           admin:grant:jcr:all
           anonomous:grant:jcr:read
then /users/branden will need
          branden:grant:jcr:write
          everyone:deny:jcr:all
          anonomous:deny:jcr:all


Certainly in 1.5.7 you cant deny access to a group,
so since everyone was granted read at / you cant deny read at /users/ 
branden

I think in JR2 group deny was enabled, but ATM we dont have JR2 in  
Sling (Felix is working on it).

The other problem is that both the AccessManagerServlets and the  
DefaultSecurityManager have blocks of code that prevent a  
group:deny:*  ACE being applied.

ie you cant set everyone:deny:jcr:all and its not processed even if  
you could.

So as part of the upgrade to 2, the checks would need to be removed in  
the access manager bundle to allow group deny.
Alternatively I think the security settings in the contentloader  
bundle will allow you to set these ACE's directly

----------------

We had exactly the same issue, so we patched everything to make it  
work. Sady the patch to the 1.5.7 DefaultSecurityManager is quite  
extensive since it requires far greater control over the order in  
which the ACL bitmap is compiled. (branded is a member of everyone is  
just one issue)

I am in the process or reworking those patches for the JR1.6 based  
server bundle, but I am not there yet, and can give you pointers to  
the code if you like.
HTH
Ian

On 5 Dec 2009, at 01:30, Branden Visser wrote:

> Hi all,
>
> This sounds like more of a JCR question then Sling, but I'm hoping  
> it's a quick answer:
>
> If I have a resource node: /users/branden, how would I make the  
> resource 'branden' and everything beneath it be private, so that no  
> other authenticated user (except branden) can read it? I looked at  
> the AccessControl spec and read up on the spec, but I didn't see  
> anything that could serve this purpose. Did I miss a document?
>
> Thanks,
> Branden
>
>