You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@jackrabbit.apache.org by th...@apache.org on 2018/08/21 10:31:38 UTC
svn commit: r1838538 [25/35] - in /jackrabbit/site/live/oak/docs: ./
architecture/ coldstandby/ features/ nodestore/ nodestore/document/
nodestore/segment/ oak-mongo-js/ oak-mongo-js/fonts/ oak-mongo-js/scripts/
oak-mongo-js/scripts/prettify/ oak-mongo...
Modified: jackrabbit/site/live/oak/docs/query/solr.html
URL: http://svn.apache.org/viewvc/jackrabbit/site/live/oak/docs/query/solr.html?rev=1838538&r1=1838537&r2=1838538&view=diff
==============================================================================
--- jackrabbit/site/live/oak/docs/query/solr.html (original)
+++ jackrabbit/site/live/oak/docs/query/solr.html Tue Aug 21 10:31:37 2018
@@ -1,13 +1,13 @@
<!DOCTYPE html>
<!--
- | Generated by Apache Maven Doxia Site Renderer 1.8.1 at 2018-08-10
+ | Generated by Apache Maven Doxia Site Renderer 1.7.4 at 2018-02-21
| Rendered using Apache Maven Fluido Skin 1.6
-->
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
- <meta name="Date-Revision-yyyymmdd" content="20180810" />
+ <meta name="Date-Revision-yyyymmdd" content="20180221" />
<meta http-equiv="Content-Language" content="en" />
<title>Jackrabbit Oak – Solr Index</title>
<link rel="stylesheet" href="../css/apache-maven-fluido-1.6.min.css" />
@@ -52,7 +52,6 @@
<a href="#" class="dropdown-toggle" data-toggle="dropdown">Main APIs <b class="caret"></b></a>
<ul class="dropdown-menu">
<li><a href="http://www.day.com/specs/jcr/2.0/index.html" title="JCR API">JCR API</a></li>
- <li><a href="https://jackrabbit.apache.org/jcr/jcr-api.html" title="Jackrabbit API">Jackrabbit API</a></li>
<li><a href="../oak_api/overview.html" title="Oak API">Oak API</a></li>
</ul>
</li>
@@ -137,7 +136,7 @@
<div id="breadcrumbs">
<ul class="breadcrumb">
- <li id="publishDate">Last Published: 2018-08-10<span class="divider">|</span>
+ <li id="publishDate">Last Published: 2018-02-21<span class="divider">|</span>
</li>
<li id="projectVersion">Version: 1.10-SNAPSHOT</li>
</ul>
@@ -156,14 +155,12 @@
<li><a href="../architecture/nodestate.html" title="The Node State Model"><span class="none"></span>The Node State Model</a> </li>
<li class="nav-header">Main APIs</li>
<li><a href="http://www.day.com/specs/jcr/2.0/index.html" class="externalLink" title="JCR API"><span class="none"></span>JCR API</a> </li>
- <li><a href="https://jackrabbit.apache.org/jcr/jcr-api.html" class="externalLink" title="Jackrabbit API"><span class="none"></span>Jackrabbit API</a> </li>
<li><a href="../oak_api/overview.html" title="Oak API"><span class="none"></span>Oak API</a> </li>
<li class="nav-header">Features and Plugins</li>
<li><a href="../nodestore/overview.html" title="Node Storage"><span class="icon-chevron-down"></span>Node Storage</a>
<ul class="nav nav-list">
<li><a href="../nodestore/documentmk.html" title="Document NodeStore"><span class="icon-chevron-down"></span>Document NodeStore</a>
<ul class="nav nav-list">
- <li><a href="../nodestore/document/mongo-document-store.html" title="MongoDB DocumentStore"><span class="none"></span>MongoDB DocumentStore</a> </li>
<li><a href="../nodestore/document/node-bundling.html" title="Node Bundling"><span class="none"></span>Node Bundling</a> </li>
<li><a href="../nodestore/document/secondary-store.html" title="Secondary Store"><span class="none"></span>Secondary Store</a> </li>
<li><a href="../nodestore/persistent-cache.html" title="Persistent Cache"><span class="none"></span>Persistent Cache</a> </li>
@@ -243,35 +240,35 @@
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
- -->
-<div class="section">
+ --><div class="section">
<h2><a name="Solr_Index"></a>Solr Index</h2>
<p>The Solr index is mainly meant for full-text search (the ‘contains’ type of queries):</p>
-<div>
-<div>
-<pre class="source">//*[jcr:contains(., 'text')]
+<div class="source">
+<div class="source"><pre class="prettyprint">//*[jcr:contains(., 'text')]
</pre></div></div>
-
<p>but is also able to search by path and property restrictions. Primary type restriction support is also provided by it’s not recommended as it’s usually much better to use the <a href="query.html#The_Node_Type_Index">node type index</a> for such kind of queries.</p>
<p>Even if it’s not just a full-text index, it’s recommended to use it asynchronously (see <tt>Oak#withAsyncIndexing</tt>) because, in most production scenarios, it’ll be a ‘remote’ index and therefore network latency / errors would have less impact on the repository performance.</p>
<p>The index definition node for a Solr-based index:</p>
-<ul>
+<ul>
+
<li>must be of type <tt>oak:QueryIndexDefinition</tt></li>
+
<li>must have the <tt>type</tt> property set to <b><tt>solr</tt></b></li>
+
<li>must contain the <tt>async</tt> property set to the value <tt>async</tt>, this is what sends the index update process to a background thread.</li>
</ul>
<p><i>Optionally</i> one can add</p>
-<ul>
+<ul>
+
<li>the <tt>reindex</tt> flag which when set to <tt>true</tt>, triggers a full content re-index.</li>
</ul>
<p>Example:</p>
-<div>
-<div>
-<pre class="source">{
+<div class="source">
+<div class="source"><pre class="prettyprint">{
NodeBuilder index = root.child("oak:index");
index.child("solr")
.setProperty("jcr:primaryType", "oak:QueryIndexDefinition", Type.NAME)
@@ -280,14 +277,15 @@
.setProperty("reindex", true);
}
</pre></div></div>
-
<p>The Oak Solr index creates one document in the Solr index for each node in the repository, each of such documents has usually at least a field for each property associated with the related node. Indexing of properties can be done by name: e.g. property ‘jcr:title’ of a node is written into a field ‘jcr:title’ of the corresponding Solr document in the index, or by type: e.g. properties ‘jcr:data’ and ‘binary_content’ of type <i>binary</i> are written into a field ‘binary_data’ that’s responsible for the indexing of all fields having that type and thus properly configured for hosting such type of data.</p>
<div class="section">
<h3><a name="Configuring_the_Solr_index"></a>Configuring the Solr index</h3>
-<p>Besides the index definition parameters mentioned above, a number of additional parameters can be defined in Oak Solr index configuration. Such a configuration is composed by:</p>
-<ul>
+<p>Besides the index definition parameters mentioned above, a number of additional parameters can be defined in Oak Solr index configuration. Such a configuration is composed by:</p>
+<ul>
+
<li>the search / indexing configuration (see <a class="externalLink" href="http://jackrabbit.apache.org/oak/docs/apidocs/org/apache/jackrabbit/oak/plugins/index/solr/configuration/OakSolrConfiguration.html">OakSolrConfiguration</a>)</li>
+
<li>the Solr server configuration (see <a class="externalLink" href="http://jackrabbit.apache.org/oak/docs/apidocs/org/apache/jackrabbit/oak/plugins/index/solr/configuration/SolrServerConfiguration.html">SolrServerConfiguration</a>)</li>
</ul></div>
<div class="section">
@@ -318,20 +316,20 @@
<h4><a name="Descendant_path_field"></a>Descendant path field</h4>
<p>The name of the field to be used for searching for nodes descendants of a certain node.</p>
<p>Default is ‘path_des’.</p>
-<p>E.g. The Solr query to find all the descendant nodes of /a/b would be ‘path_des:/a/b’.</p></div>
+<p>E.g. The Solr query to find all the descendant nodes of /a/b would be ‘path_des:\/a\/b’.</p></div>
<div class="section">
<h4><a name="Children_path_field"></a>Children path field</h4>
<p>The name of the field to be used for searching for child nodes of a certain node.</p>
<p>Default is ‘path_child’.</p>
-<p>E.g. The Solr query to find all the child nodes of /a/b would be ‘path_child:/a/b’.</p></div>
+<p>E.g. The Solr query to find all the child nodes of /a/b would be ‘path_child:\/a\/b’.</p></div>
<div class="section">
<h4><a name="Parent_path_field"></a>Parent path field</h4>
<p>The name of the field to be used for searching for parent node of a certain node.</p>
<p>Default is ‘path_anc’.</p>
-<p>E.g. The Solr query to find the parent node of /a/b would be ‘path_anc:/a/b’.</p></div>
+<p>E.g. The Solr query to find the parent node of /a/b would be ‘path_anc:\/a\/b’.</p></div>
<div class="section">
<h4><a name="Property_restriction_fields"></a>Property restriction fields</h4>
-<p>The (optional) mapping of property names into Solr fields, so that a mapping jcr:title=foo is defined each node having the property jcr:title will have its correspondant Solr document having a property foo indexed with the value of the jcr:title property.</p>
+<p>The (optional) mapping of property names into Solr fields, so that a mapping jcr:title=foo is defined each node having the property jcr:title will have its correspondant Solr document having a property foo indexed with the value of the jcr:title property.</p>
<p>Default is no mapping, therefore the default mechanism of mapping property names to field names is performed.</p></div>
<div class="section">
<h4><a name="Used_properties"></a>Used properties</h4>
@@ -341,7 +339,7 @@
<div class="section">
<h4><a name="aIgnored_properties"></a> Ignored properties</h4>
<p>A blacklist of properties to be ignored while indexing and searching by the Solr index.</p>
-<p>Such a blacklist makes sense (it will be taken into account by the Solr index) only if the <a href="#Used_properties">Used properties</a> option doesn’t have any value.</p>
+<p>Such a blacklist makes sense (it will be taken into account by the Solr index) only if the <a href="#Used_properties">Used properties</a> option doesn’t have any value.</p>
<p>Default is the following array: <i>(“rep:members”, “rep:authorizableId”, “jcr:uuid”, “rep:principalName”, “rep:password”}</i>.</p></div>
<div class="section">
<h4><a name="Commit_policy"></a>Commit policy</h4>
@@ -354,11 +352,11 @@
<div class="section">
<h4><a name="Rows"></a>Rows</h4>
<p>The number of documents per ‘page’ to be fetched for each query.</p>
-<p>Default is <i>Integer.MAX_VALUE</i> (was <i>50</i> in Oak 1.0).</p></div>
+<p>Default is _Integer.MAX<i>VALUE</i> (was <i>50</i> in Oak 1.0).</p></div>
<div class="section">
<h4><a name="Collapse_jcr:content_nodes"></a>Collapse <i>jcr:content</i> nodes</h4>
<p><tt>@since 1.3.4, 1.2.4, 1.0.18</tt></p>
-<p>Whether the <a class="externalLink" href="https://cwiki.apache.org/confluence/display/solr/Collapse+and+Expand+Results">Collapsing query parser</a> should be used when searching in order to collapse nodes that are descendants of ‘jcr:content’ nodes into the ‘jcr:content’ node only. E.g. if normal query results would include ‘/a/jcr:content’ and ‘/a/jcr:content/b/’, with this option enabled only ‘/a/jcr:content’ would be returned by Solr using the Collapsing query parser. This feature requires an additional field to be indexed, therefore if this is turned on, reindexing should be triggered in order to make it work properly.</p></div>
+<p>Whether the <a class="externalLink" href="https://cwiki.apache.org/confluence/display/solr/Collapse+and+Expand+Results">Collapsing query parser</a> should be used when searching in order to collapse nodes that are descendants of ‘jcr:content’ nodes into the ‘jcr:content’ node only. E.g. if normal query results would include ‘/a/jcr:content’ and ‘/a/jcr:content/b/’, with this option enabled only ‘/a/jcr:content’ would be returned by Solr using the Collapsing query parser. This feature requires an additional field to be indexed, therefore if this is turned on, reindexing should be triggered in order to make it work properly. </p></div>
<div class="section">
<h4><a name="Collapsed_path_field"></a>Collapsed path field</h4>
<p><tt>@since 1.3.4, 1.2.4, 1.0.18</tt></p>
@@ -368,13 +366,17 @@
<p>TBD</p></div></div>
<div class="section">
<h4><a name="Setting_up_the_Solr_server"></a>Setting up the Solr server</h4>
-<p>For the Solr index to work Oak needs to be able to communicate with a Solr instance / cluster. Apache Solr supports multiple deployment architectures:</p>
-<ul>
+<p>For the Solr index to work Oak needs to be able to communicate with a Solr instance / cluster. Apache Solr supports multiple deployment architectures: </p>
+<ul>
+
<li>embedded Solr instance running in the same JVM the client runs into</li>
+
<li>single remote instance</li>
+
<li>master / slave architecture, eventually with multiple shards and replicas</li>
-<li>SolrCloud cluster, with Zookeeper instance(s) to control a dynamic, resilient set of Solr servers for high availability and fault tolerance</li>
+
+<li>SolrCloud cluster, with Zookeeper instance(s) to control a dynamic, resilient set of Solr servers for high availability and fault tolerance</li>
</ul>
<p>The Oak Solr index can be configured to either use an ‘embedded Solr server’ or a ‘remote Solr server’ (being able to connect to a single remote instance or to a SolrCloud cluster via Zookeeper).</p>
<div class="section">
@@ -382,20 +384,23 @@
<p>Depending on the use case, different Solr server deployments are recommended.</p>
<div class="section">
<h6><a name="Embedded_Solr_server"></a>Embedded Solr server</h6>
-<p>The embedded Solr server is recommended for developing and testing the Solr index for an Oak repository. With that an in-memory Solr instance is started in the same JVM of the Oak repository, without HTTP bindings (for security purposes as it’d allow HTTP access to repository data independently of ACLs). Configuring an embedded Solr server mainly consists of providing the path to a standard <a class="externalLink" href="https://wiki.apache.org/solr/SolrTerminology">Solr home dir</a> (<i>solr.home.path</i> Oak property) to be used to start Solr; this path can be either relative or absolute, if such a path would not exist then the default configuration provided with <i>oak-solr-core</i> artifact would be put in the given path. To start an embedded Solr server with a custom configuration (e.g. different schema.xml / solrconfig.xml than the default ones) the (modified) Solr home files would have to be put in a dedicated directory, according to Solr home structure, so that the
solr.home.path property can be pointed to that directory.</p></div>
+<p>The embedded Solr server is recommended for developing and testing the Solr index for an Oak repository. With that an in-memory Solr instance is started in the same JVM of the Oak repository, without HTTP bindings (for security purposes as it’d allow HTTP access to repository data independently of ACLs). Configuring an embedded Solr server mainly consists of providing the path to a standard <a class="externalLink" href="https://wiki.apache.org/solr/SolrTerminology">Solr home dir</a> (<i>solr.home.path</i> Oak property) to be used to start Solr; this path can be either relative or absolute, if such a path would not exist then the default configuration provided with <i>oak-solr-core</i> artifact would be put in the given path. To start an embedded Solr server with a custom configuration (e.g. different schema.xml / solrconfig.xml than the default ones) the (modified) Solr home files would have to be put in a dedicated directory, according to Solr home structure, so that th
e solr.home.path property can be pointed to that directory.</p></div>
<div class="section">
<h6><a name="Single_remote_Solr_server"></a>Single remote Solr server</h6>
-<p>A single (remote) Solr instance is the simplest possible setup for using the Oak Solr index in a production environment. Oak will communicate to such a Solr server through Solr’s HTTP APIs (via <a class="externalLink" href="http://wiki.apache.org/solr/Solrj">SolrJ</a> client). Configuring a single remote Solr instance consists of providing the URL to connect to in order to reach the [Solr core] (<a class="externalLink" href="https://wiki.apache.org/solr/SolrTerminology">https://wiki.apache.org/solr/SolrTerminology</a>) that will host the Solr index for the Oak repository via the <i>solr.http.url</i> property which will have to contain such a URL (e.g. <i><a class="externalLink" href="http://10.10.1.101:8983/solr/oak">http://10.10.1.101:8983/solr/oak</a></i>). All the configuration and tuning of Solr, other than what’s described on this page, will have to be performed on the Solr side; <a class="externalLink" href="http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oa
k-solr-core/src/main/resources/solr/">sample Solr configuration</a> files (schema.xml, solrconfig.xml, etc.) to start with can be found in <i>oak-solr-core</i> artifact.</p></div>
+<p>A single (remote) Solr instance is the simplest possible setup for using the Oak Solr index in a production environment. Oak will communicate to such a Solr server through Solr’s HTTP APIs (via <a class="externalLink" href="http://wiki.apache.org/solr/Solrj">SolrJ</a> client). Configuring a single remote Solr instance consists of providing the URL to connect to in order to reach the <a class="externalLink" href="https://wiki.apache.org/solr/SolrTerminology">Solr core</a> that will host the Solr index for the Oak repository via the <i>solr.http.url</i> property which will have to contain such a URL (e.g. _<a class="externalLink" href="http://10.10.1.101:8983/solr/oak_)">http://10.10.1.101:8983/solr/oak_)</a>. All the configuration and tuning of Solr, other than what’s described on this page, will have to be performed on the Solr side; <a class="externalLink" href="http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-solr-core/src/main/resources/solr/">sample Solr c
onfiguration</a> files (schema.xml, solrconfig.xml, etc.) to start with can be found in <i>oak-solr-core</i> artifact.</p></div>
<div class="section">
<h6><a name="SolrCloud_cluster"></a>SolrCloud cluster</h6>
-<p>A <a class="externalLink" href="https://cwiki.apache.org/confluence/display/solr/SolrCloud">SolrCloud</a> cluster is the recommended setup for an Oak Solr index in production as it provides a scalable and fault tolerant architecture. In order to configure a SolrCloud cluster the host of the Zookeeper instance / ensemble managing the Solr servers has to be provided in the <i>solr.zk.host</i> property (e.g. <i>10.1.1.108:9983</i>) since the SolrJ client for SolrCloud communicates directly with Zookeeper. The <a class="externalLink" href="https://wiki.apache.org/solr/SolrTerminology">Solr collection</a> to be used within Oak is named <i>oak</i>, having a replication factor of 2 and using 2 shards; this means in the default setup the SolrCloud cluster would have to be composed by at least 4 Solr servers as the index will be split into 2 shards and each shard will have 2 replicas. SolrCloud also allows the hot deploy of configuration files to be used for a certain collection so while
setting up the collection to be used for Oak with the needed files before starting the cluster, configuration files can also be uploaded from a local directory, this is controlled by the <i>solr.conf.dir</i> property of the ‘Oak Solr remote server configuration’. For a detailed description of how SolrCloud works see the <a class="externalLink" href="https://cwiki.apache.org/confluence/display/solr/SolrCloud">Solr reference guide</a>.</p></div></div>
+<p>A <a class="externalLink" href="https://cwiki.apache.org/confluence/display/solr/SolrCloud">SolrCloud</a> cluster is the recommended setup for an Oak Solr index in production as it provides a scalable and fault tolerant architecture. In order to configure a SolrCloud cluster the host of the Zookeeper instance / ensemble managing the Solr servers has to be provided in the <i>solr.zk.host</i> property (e.g. <i>10.1.1.108:9983</i>) since the SolrJ client for SolrCloud communicates directly with Zookeeper. The <a class="externalLink" href="https://wiki.apache.org/solr/SolrTerminology">Solr collection</a> to be used within Oak is named <i>oak</i>, having a replication factor of 2 and using 2 shards; this means in the default setup the SolrCloud cluster would have to be composed by at least 4 Solr servers as the index will be split into 2 shards and each shard will have 2 replicas. SolrCloud also allows the hot deploy of configuration files to be used for a certain collection so whil
e setting up the collection to be used for Oak with the needed files before starting the cluster, configuration files can also be uploaded from a local directory, this is controlled by the <i>solr.conf.dir</i> property of the ‘Oak Solr remote server configuration’. For a detailed description of how SolrCloud works see the <a class="externalLink" href="https://cwiki.apache.org/confluence/display/solr/SolrCloud">Solr reference guide</a>.</p></div></div>
<div class="section">
<h5><a name="OSGi_environment"></a>OSGi environment</h5>
<p>Create an index definition for the Solr index, as described <a href="#Solr_index">above</a>. Once the query index definition node has been created, access OSGi ConfigurationAdmin via e.g. Apache Felix WebConsole:</p>
-<ol style="list-style-type: decimal">
+<ol style="list-style-type: decimal">
+
<li>find the ‘Oak Solr indexing / search configuration’ item and eventually change configuration properties as needed</li>
-<li>find either the ‘Oak Solr embedded server configuration’ or ‘Oak Solr remote server configuration’ items depending on the chosen Solr architecture and eventually change configuration properties as needed</li>
+
+<li>find either the ‘Oak Solr embedded server configuration’ or ‘Oak Solr remote server configuration’ items depending on the chosen Solr architecture and eventually change configuration properties as needed</li>
+
<li>find the ‘Oak Solr server provider’ item and select the chosen provider (‘remote’ or ‘embedded’)</li>
</ol></div></div>
<div class="section">
@@ -403,7 +408,7 @@
<div class="section">
<h5><a name="Aggregation"></a>Aggregation</h5>
<p><tt>@since Oak 1.1.4, 1.0.13</tt></p>
-<p>Solr index supports query time aggregation, that can be enabled in OSGi by setting <tt>SolrQueryIndexProviderService</tt> service property <tt>query.aggregation</tt> to true.</p></div>
+<p>Solr index supports query time aggregation, that can be enabled in OSGi by setting <tt>SolrQueryIndexProviderService</tt> service property <tt>query.aggregation</tt> to true. </p></div>
<div class="section">
<h5><a name="Suggestions"></a>Suggestions</h5>
<p><tt>@since Oak 1.1.17, 1.0.15</tt></p>
@@ -419,26 +424,21 @@
<p><tt>@since Oak 1.3.14</tt></p>
<p>In order to enable proper usage of facets in Solr index the following dynamic field needs to be added to the <i>schema.xml</i></p>
-<div>
-<div>
-<pre class="source"> <dynamicField name="*_facet" type="string" indexed="false" stored="false" docValues="true" multiValued="true"/>
+<div class="source">
+<div class="source"><pre class="prettyprint"> <dynamicField name="*_facet" type="string" indexed="false" stored="false" docValues="true" multiValued="true"/>
</pre></div></div>
-
<p>with dedicated <i>copyFields</i> for specific properties.</p>
-<div>
-<div>
-<pre class="source"> <copyField source="jcr:primaryType" dest="jcr:primaryType_facet"/> <!-- facet on jcr:primaryType field/property -->
-</pre></div></div>
-</div>
+<div class="source">
+<div class="source"><pre class="prettyprint"> <copyField source="jcr:primaryType" dest="jcr:primaryType_facet"/> <!-- facet on jcr:primaryType field/property -->
+</pre></div></div></div>
<div class="section">
<h4><a name="Persisted_configuration"></a>Persisted configuration</h4>
<p><tt>@since Oak 1.4.0</tt></p>
-<p>It’s possible to create (multiple) Solr indexes via persisted configuration. A persisted Oak Solr index is created whenever an index definition with <i>type = solr</i> has a child node named <i>server</i> and such a child node has the <i>solrServerType</i> property set (to either <i>embedded</i> or <i>remote</i>). If no such child node exists, an Oak Solr index will be only created upon explicit registration of a [SolrServerProvider] e.g. via OSGi. All the <a class="externalLink" href="http://jackrabbit.apache.org/oak/docs/apidocs/org/apache/jackrabbit/oak/plugins/index/solr/configuration/OakSolrConfiguration.html">OakSolrConfiguration</a> and <a class="externalLink" href="http://jackrabbit.apache.org/oak/docs/apidocs/org/apache/jackrabbit/oak/plugins/index/solr/configuration/SolrServerConfiguration.html">SolrServerConfiguration</a> properties are exposed and configurable, see also <a class="externalLink" href="https://github.com/apache/jackrabbit-oak/blob/trunk/oak-solr-c
ore/src/main/java/org/apache/jackrabbit/oak/plugins/index/solr/configuration/nodestate/OakSolrNodeStateConfiguration.java#L245">OakSolrNodeStateConfiguration#Properties</a> and <a class="externalLink" href="https://github.com/apache/jackrabbit-oak/blob/trunk/oak-solr-core/src/main/java/org/apache/jackrabbit/oak/plugins/index/solr/configuration/nodestate/NodeStateSolrServerConfigurationProvider.java#L94">NodeStateSolrServerConfigurationProvider#Properties</a></p>
+<p>It’s possible to create (multiple) Solr indexes via persisted configuration. A persisted Oak Solr index is created whenever an index definition with <i>type = solr</i> has a child node named <i>server</i> and such a child node has the <i>solrServerType</i> property set (to either <i>embedded</i> or <i>remote</i>). If no such child node exists, an Oak Solr index will be only created upon explicit registration of a [SolrServerProvider] e.g. via OSGi. All the <a class="externalLink" href="http://jackrabbit.apache.org/oak/docs/apidocs/org/apache/jackrabbit/oak/plugins/index/solr/configuration/OakSolrConfiguration.html">OakSolrConfiguration</a> and <a class="externalLink" href="http://jackrabbit.apache.org/oak/docs/apidocs/org/apache/jackrabbit/oak/plugins/index/solr/configuration/SolrServerConfiguration.html">SolrServerConfiguration</a> properties are exposed and configurable, see also <a class="externalLink" href="https://github.com/apache/jackrabbit-oak/blob/trunk/oak-sol
r-core/src/main/java/org/apache/jackrabbit/oak/plugins/index/solr/configuration/nodestate/OakSolrNodeStateConfiguration.java#L245">OakSolrNodeStateConfiguration#Properties</a> and <a class="externalLink" href="https://github.com/apache/jackrabbit-oak/blob/trunk/oak-solr-core/src/main/java/org/apache/jackrabbit/oak/plugins/index/solr/configuration/nodestate/NodeStateSolrServerConfigurationProvider.java#L94">NodeStateSolrServerConfigurationProvider#Properties</a></p>
-<div>
-<div>
-<pre class="source">/oak:index/solrRemote
+<div class="source">
+<div class="source"><pre class="prettyprint">/oak:index/solrRemote
- jcr:primaryType = "oak:QueryIndexDefinition"
- type = "solr"
- async = "async"
@@ -447,20 +447,23 @@
- solrServerType = "remote"
- httpUrl = "http://localhost:8983/solr/oak"
</pre></div></div>
-
<p>If such configurations exists in the repository the <a class="externalLink" href="http://jackrabbit.apache.org/oak/docs/apidocs/org/apache/jackrabbit/oak/plugins/index/solr/configuration/nodestate/NodeStateSolrServersObserver.html">NodeStateSolrServersObserver</a> should be registered too (e.g. via <a class="externalLink" href="http://jackrabbit.apache.org/oak/docs/apidocs/org/apache/jackrabbit/oak/plugins/index/solr/osgi/NodeStateSolrServersObserverService.html">NodeStateSolrServersObserverService</a> OSGi service).</p></div>
<div class="section">
<h4><a name="Notes"></a>Notes</h4>
<p>As of Oak version 1.0.0:</p>
-<ul>
+<ul>
+
<li>Solr index doesn’t support search using relative properties, see <a class="externalLink" href="https://issues.apache.org/jira/browse/OAK-1835">OAK-1835</a>.</li>
+
<li>Lucene can only be used for full-text queries, Solr can be used for full-text search <i>and</i> for JCR queries involving path, property and primary type restrictions.</li>
</ul>
<p>As of Oak version 1.2.0:</p>
-<ul>
+<ul>
+
<li>Solr index doesn’t support index time aggregation, but only query time aggregation</li>
+
<li>Lucene and Solr can be both used for full text, property and path restrictions</li>
</ul></div></div></div>
</div>
Modified: jackrabbit/site/live/oak/docs/release-schedule.html
URL: http://svn.apache.org/viewvc/jackrabbit/site/live/oak/docs/release-schedule.html?rev=1838538&r1=1838537&r2=1838538&view=diff
==============================================================================
--- jackrabbit/site/live/oak/docs/release-schedule.html (original)
+++ jackrabbit/site/live/oak/docs/release-schedule.html Tue Aug 21 10:31:37 2018
@@ -1,13 +1,13 @@
<!DOCTYPE html>
<!--
- | Generated by Apache Maven Doxia Site Renderer 1.8.1 at 2018-08-10
+ | Generated by Apache Maven Doxia Site Renderer 1.7.4 at 2018-04-27
| Rendered using Apache Maven Fluido Skin 1.6
-->
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
- <meta name="Date-Revision-yyyymmdd" content="20180810" />
+ <meta name="Date-Revision-yyyymmdd" content="20180427" />
<meta http-equiv="Content-Language" content="en" />
<title>Jackrabbit Oak – Release Schedule</title>
<link rel="stylesheet" href="./css/apache-maven-fluido-1.6.min.css" />
@@ -52,7 +52,6 @@
<a href="#" class="dropdown-toggle" data-toggle="dropdown">Main APIs <b class="caret"></b></a>
<ul class="dropdown-menu">
<li><a href="http://www.day.com/specs/jcr/2.0/index.html" title="JCR API">JCR API</a></li>
- <li><a href="https://jackrabbit.apache.org/jcr/jcr-api.html" title="Jackrabbit API">Jackrabbit API</a></li>
<li><a href="oak_api/overview.html" title="Oak API">Oak API</a></li>
</ul>
</li>
@@ -137,7 +136,7 @@
<div id="breadcrumbs">
<ul class="breadcrumb">
- <li id="publishDate">Last Published: 2018-08-10<span class="divider">|</span>
+ <li id="publishDate">Last Published: 2018-04-27<span class="divider">|</span>
</li>
<li id="projectVersion">Version: 1.10-SNAPSHOT</li>
</ul>
@@ -156,14 +155,12 @@
<li><a href="architecture/nodestate.html" title="The Node State Model"><span class="none"></span>The Node State Model</a> </li>
<li class="nav-header">Main APIs</li>
<li><a href="http://www.day.com/specs/jcr/2.0/index.html" class="externalLink" title="JCR API"><span class="none"></span>JCR API</a> </li>
- <li><a href="https://jackrabbit.apache.org/jcr/jcr-api.html" class="externalLink" title="Jackrabbit API"><span class="none"></span>Jackrabbit API</a> </li>
<li><a href="oak_api/overview.html" title="Oak API"><span class="none"></span>Oak API</a> </li>
<li class="nav-header">Features and Plugins</li>
<li><a href="nodestore/overview.html" title="Node Storage"><span class="icon-chevron-down"></span>Node Storage</a>
<ul class="nav nav-list">
<li><a href="nodestore/documentmk.html" title="Document NodeStore"><span class="icon-chevron-down"></span>Document NodeStore</a>
<ul class="nav nav-list">
- <li><a href="nodestore/document/mongo-document-store.html" title="MongoDB DocumentStore"><span class="none"></span>MongoDB DocumentStore</a> </li>
<li><a href="nodestore/document/node-bundling.html" title="Node Bundling"><span class="none"></span>Node Bundling</a> </li>
<li><a href="nodestore/document/secondary-store.html" title="Secondary Store"><span class="none"></span>Secondary Store</a> </li>
<li><a href="nodestore/persistent-cache.html" title="Persistent Cache"><span class="none"></span>Persistent Cache</a> </li>
@@ -243,16 +240,21 @@
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
- -->
-<h1>Release Schedule</h1>
+ --><h1>Release Schedule</h1>
<p>Here is the frequency where the team <b>aim</b> to cut new releases. As we strive for quality rather than frequency the date may slip according to needs.</p>
-<ul>
+<ul>
+
<li>Trunk: every 2 weeks (2 / month, ~26 /year)</li>
+
<li>1.8: every 4 weeks (1 / month, ~12 / year)</li>
+
<li>1.6: every 8 weeks (1 / other month, ~6 / year)</li>
+
<li>1.4: every 13 weeks (1 / quarter, ~4 / year)</li>
+
<li>1.2: every 13 weeks (1 / quarter, ~4 / year)</li>
+
<li>1.0: every 26 weeks (~2 / year)</li>
</ul>
</div>
Modified: jackrabbit/site/live/oak/docs/security/accesscontrol.html
URL: http://svn.apache.org/viewvc/jackrabbit/site/live/oak/docs/security/accesscontrol.html?rev=1838538&r1=1838537&r2=1838538&view=diff
==============================================================================
--- jackrabbit/site/live/oak/docs/security/accesscontrol.html (original)
+++ jackrabbit/site/live/oak/docs/security/accesscontrol.html Tue Aug 21 10:31:37 2018
@@ -1,13 +1,13 @@
<!DOCTYPE html>
<!--
- | Generated by Apache Maven Doxia Site Renderer 1.8.1 at 2018-08-10
+ | Generated by Apache Maven Doxia Site Renderer 1.7.4 at 2018-02-21
| Rendered using Apache Maven Fluido Skin 1.6
-->
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
- <meta name="Date-Revision-yyyymmdd" content="20180810" />
+ <meta name="Date-Revision-yyyymmdd" content="20180221" />
<meta http-equiv="Content-Language" content="en" />
<title>Jackrabbit Oak – Access Control Management</title>
<link rel="stylesheet" href="../css/apache-maven-fluido-1.6.min.css" />
@@ -52,7 +52,6 @@
<a href="#" class="dropdown-toggle" data-toggle="dropdown">Main APIs <b class="caret"></b></a>
<ul class="dropdown-menu">
<li><a href="http://www.day.com/specs/jcr/2.0/index.html" title="JCR API">JCR API</a></li>
- <li><a href="https://jackrabbit.apache.org/jcr/jcr-api.html" title="Jackrabbit API">Jackrabbit API</a></li>
<li><a href="../oak_api/overview.html" title="Oak API">Oak API</a></li>
</ul>
</li>
@@ -137,7 +136,7 @@
<div id="breadcrumbs">
<ul class="breadcrumb">
- <li id="publishDate">Last Published: 2018-08-10<span class="divider">|</span>
+ <li id="publishDate">Last Published: 2018-02-21<span class="divider">|</span>
</li>
<li id="projectVersion">Version: 1.10-SNAPSHOT</li>
</ul>
@@ -156,14 +155,12 @@
<li><a href="../architecture/nodestate.html" title="The Node State Model"><span class="none"></span>The Node State Model</a> </li>
<li class="nav-header">Main APIs</li>
<li><a href="http://www.day.com/specs/jcr/2.0/index.html" class="externalLink" title="JCR API"><span class="none"></span>JCR API</a> </li>
- <li><a href="https://jackrabbit.apache.org/jcr/jcr-api.html" class="externalLink" title="Jackrabbit API"><span class="none"></span>Jackrabbit API</a> </li>
<li><a href="../oak_api/overview.html" title="Oak API"><span class="none"></span>Oak API</a> </li>
<li class="nav-header">Features and Plugins</li>
<li><a href="../nodestore/overview.html" title="Node Storage"><span class="icon-chevron-down"></span>Node Storage</a>
<ul class="nav nav-list">
<li><a href="../nodestore/documentmk.html" title="Document NodeStore"><span class="icon-chevron-down"></span>Document NodeStore</a>
<ul class="nav nav-list">
- <li><a href="../nodestore/document/mongo-document-store.html" title="MongoDB DocumentStore"><span class="none"></span>MongoDB DocumentStore</a> </li>
<li><a href="../nodestore/document/node-bundling.html" title="Node Bundling"><span class="none"></span>Node Bundling</a> </li>
<li><a href="../nodestore/document/secondary-store.html" title="Secondary Store"><span class="none"></span>Secondary Store</a> </li>
<li><a href="../nodestore/persistent-cache.html" title="Persistent Cache"><span class="none"></span>Persistent Cache</a> </li>
@@ -242,148 +239,179 @@
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
--->
-<div class="section">
+--><div class="section">
<h2><a name="Access_Control_Management"></a>Access Control Management</h2>
<div class="section">
<h3><a name="General"></a>General</h3>
-<p>This section covers fundamental concepts of the access control related APIs provided by JCR and Jackrabbit as well as the extensions points defined by Oak.</p>
+<p>This section covers fundamental concepts of the access control related APIs provided by JCR and Jackrabbit as well as the extensions points defined by Oak. </p>
<p>If you are already familiar with the API and looking for examples you may directly read <a href="accesscontrol/editing.html">Using the Access Control Management API</a> for a comprehensive list of method calls as well as examples that may be used to edit the access control content of the repository.</p>
-<a name="jcr_api"></a>
-### JCR API
-
+<p><a name="jcr_api"></a></p></div>
+<div class="section">
+<h3><a name="JCR_API"></a>JCR API</h3>
<p>Access Control Management is an optional feature defined by <a class="externalLink" href="http://www.day.com/specs/jcr/2.0/16_Access_Control_Management.html">JSR 283</a> consisting of</p>
-<blockquote>
+<blockquote>
<p>• Privilege discovery: Determining the privileges that a user has in relation to a node.</p>
<p>• Assigning access control policies: Setting the privileges that a user has in relation to a node using access control policies specific to the implementation.</p>
</blockquote>
<p>Whether or not a given implementation supports access control management is defined by the <tt>Repository.OPTION_ACCESS_CONTROL_SUPPORTED</tt> descriptor.</p>
<p>Since Oak comes with a dedicated <a href="privilege.html">privilege management</a> this section focuses on reading and editing access control information. The main interfaces defined by JSR 283 are:</p>
-<ul>
+<ul>
+
<li><tt>AccessControlManager</tt>: Main entry point for access control related operations</li>
+
<li><tt>AccessControlPolicy</tt>: Marker interface for any kind of policies defined by the implementation.
+
<ul>
-
+
<li><tt>AccessControlList</tt>: mutable policy that may have a list of entries.</li>
+
<li><tt>NamedAccessControlPolicy</tt>: opaque immutable policy with a JCR name.</li>
-</ul>
-</li>
+ </ul></li>
+
<li><tt>AccessControlEntry</tt>: association of privilege(s) with a given principal bound to a given node by the <tt>AccessControlList</tt>.</li>
</ul>
<p>The JCR access control management has the following characteristics:</p>
-<ul>
+<ul>
+
<li><i>path-based</i>: policies are bound to nodes; a given node may have multiple policies; the <tt>null</tt> path identifies repository level policies.</li>
+
<li><i>transient</i>: access control related modifications are always transient</li>
+
<li><i>binding</i>: policies are decoupled from the repository; in order to bind a policy to a node or apply modifications made to an existing policy <tt>AccessControlManager.setPolicy</tt> must be called.</li>
+
<li><i>effect</i>: policies bound to a given node only take effect upon <tt>Session.save()</tt>. Access to properties is defined by the their parent node.</li>
+
<li><i>scope</i>: a given policy may not only affect the node it is bound to but may have an effect on accessibility of items elsewhere in the workspace.</li>
</ul>
-<a name="jackrabbit_api"></a>
-### Jackrabbit API
-
+<p><a name="jackrabbit_api"></a></p></div>
+<div class="section">
+<h3><a name="Jackrabbit_API"></a>Jackrabbit API</h3>
<p>The Jackrabbit API defines various access control related extensions to the JCR API in order to cover common needs such as for example:</p>
-<ul>
+<ul>
+
<li><i>deny access</i>: access control entries can be defined to deny privileges at a given path (JCR only defines allowing access control entries)</li>
+
<li><i>restrictions</i>: limit the effect of a given access control entry by the mean of restrictions</li>
+
<li><i>convenience</i>:
+
<ul>
-
+
<li>reordering of access control entries in a access control list</li>
+
<li>retrieve the path of the node a given policy is (or can be) bound to</li>
-</ul>
-</li>
+ </ul></li>
+
<li><i>principal-based</i>:
+
<ul>
-
+
<li>principal-based access control management API (in contrast to the path-based default specified by JSR 283)</li>
+
<li>privilege discovery for a set of principals</li>
-</ul>
-</li>
+ </ul></li>
</ul>
<p>The following interfaces and extensions are defined:</p>
-<ul>
+<ul>
+
<li><tt>JackrabbitAccessControlManager</tt></li>
+
<li><tt>JackrabbitAccessControlPolicy</tt></li>
+
<li><tt>JackrabbitAccessControlList</tt></li>
+
<li><tt>JackrabbitAccessControlEntry</tt></li>
</ul>
-<a name="api_extensions"></a>
-### API Extensions
-
+<p><a name="api_extensions"></a></p></div>
+<div class="section">
+<h3><a name="API_Extensions"></a>API Extensions</h3>
<p>Oak defines the following interfaces extending the access control management API:</p>
-<ul>
-<li><tt>PolicyOwner</tt>: Interface to improve pluggability of the access control management and allows to termine if a giving manager handles a given policy.</li>
+<ul>
+
+<li><tt>PolicyOwner</tt>: Interface to improve pluggability of the access control management and allows to termine if a giving manager handles a given policy.</li>
+
<li><tt>AccessControlConstants</tt>: Constants related to access control management.</li>
</ul>
<p>In addition it provides some access control related base classes in <tt>org.apache.jackrabbit.oak.spi.security.authorization.accesscontrol</tt> that may be used for a custom implementation:</p>
-<ul>
+<ul>
+
<li><tt>AbstractAccessControlList</tt>: abstract base implementation of the <tt>JackrabbitAccessControlList</tt> interface
+
<ul>
-
+
<li><tt>ImmutableACL</tt>: immutable subclass of <tt>AbstractAccessControlList</tt></li>
+
<li><tt>ACE</tt>: abstract subclass that implements common methods of a mutable access control list.</li>
-</ul>
-</li>
+ </ul></li>
</ul>
<div class="section">
<h4><a name="Restriction_Management"></a>Restriction Management</h4>
<p>Oak 1.0 defines a dedicated restriction management API. See <a href="authorization/restriction.html">Restriction Management</a> for details and further information regarding extensibility and pluggability.</p>
-<a name="utilities"></a>
-### Utilities
-
+<p><a name="utilities"></a></p></div></div>
+<div class="section">
+<h3><a name="Utilities"></a>Utilities</h3>
<p>The jcr-commons module present with Jackrabbit provide some access control related utilities that simplify the creation of new policies and entries such as for example:</p>
-<ul>
+<ul>
+
<li><tt>AccessControlUtils.getAccessControlList(Session, String)</tt></li>
+
<li><tt>AccessControlUtils.getAccessControlList(AccessControlManager, String)</tt></li>
+
<li><tt>AccessControlUtils.addAccessControlEntry(Session, String, Principal, String[], boolean)</tt></li>
</ul>
<p>See <a class="externalLink" href="http://svn.apache.org/repos/asf/jackrabbit/trunk/jackrabbit-jcr-commons/src/main/java/org/apache/jackrabbit/commons/jackrabbit/authorization/AccessControlUtils.java">org.apache.jackrabbit.commons.jackrabbit.authorization.AccessControlUtils</a> for the complete list of methods.</p>
<div class="section">
+<div class="section">
<h5><a name="Examples"></a>Examples</h5>
-<div>
-<div>
-<pre class="source">String path = node.getPath();
+<div class="source">
+<div class="source"><pre class="prettyprint">String path = node.getPath();
JackrabbitAccessControlList acl = AccessControlUtils.getAccessControlList(session, path);
acl.addEntry(principal, privileges, true);
acMgr.setPolicy(path, acl);
session.save();
</pre></div></div>
-<a name="default_implementation"></a>
-### Characteristics of the Default Implementation
-
-<p>The behavior of the default access control implementation is described in sections <a href="accesscontrol/default.html">Access Control Management: The Default Implementation</a><br />
-and <a href="authorization/restriction.html">Restriction Management</a>.</p>
-<a name="configuration"></a>
-### Configuration
-
+<p><a name="default_implementation"></a></p></div></div></div>
+<div class="section">
+<h3><a name="Characteristics_of_the_Default_Implementation"></a>Characteristics of the Default Implementation</h3>
+<p>The behavior of the default access control implementation is described in sections <a href="accesscontrol/default.html">Access Control Management: The Default Implementation</a><br />and <a href="authorization/restriction.html">Restriction Management</a>.</p>
+<p><a name="configuration"></a></p></div>
+<div class="section">
+<h3><a name="Configuration"></a>Configuration</h3>
<p>The configuration of the access control management implementation is handled within the <a href="/oak/docs/apidocs/org/apache/jackrabbit/oak/spi/security/authorization/AuthorizationConfiguration.html">AuthorizationConfiguration</a>, which is used for all authorization related matters. This class provides the following two access control related methods:</p>
-<ul>
+<ul>
+
<li><tt>getAccessControlManager</tt>: get a new ac manager instance.</li>
+
<li><tt>getRestrictionProvider</tt>: get a new instance of the restriction provider.</li>
-</ul></div></div>
+</ul>
<div class="section">
<h4><a name="Configuration_Parameters"></a>Configuration Parameters</h4>
<p>The supported configuration options of the default implementation are described in the corresponding <a href="accesscontrol/default.html#configuration">section</a>.</p>
-<a name="further_reading"></a>
-### Further Reading
+<p><a name="further_reading"></a></p></div></div>
+<div class="section">
+<h3><a name="Further_Reading"></a>Further Reading</h3>
<ul>
-
+
<li><a href="accesscontrol/differences.html">Differences wrt Jackrabbit 2.x</a></li>
+
<li><a href="accesscontrol/default.html">Access Control Management: The Default Implementation</a></li>
+
<li><a href="accesscontrol/editing.html">Using the Access Control Management API</a></li>
+
<li><a href="authorization/restriction.html">Restriction Management</a></li>
-</ul><!-- hidden references --></div></div></div>
+</ul>
+<!-- hidden references --></div></div>
</div>
</div>
</div>
Modified: jackrabbit/site/live/oak/docs/security/accesscontrol/default.html
URL: http://svn.apache.org/viewvc/jackrabbit/site/live/oak/docs/security/accesscontrol/default.html?rev=1838538&r1=1838537&r2=1838538&view=diff
==============================================================================
--- jackrabbit/site/live/oak/docs/security/accesscontrol/default.html (original)
+++ jackrabbit/site/live/oak/docs/security/accesscontrol/default.html Tue Aug 21 10:31:37 2018
@@ -1,13 +1,13 @@
<!DOCTYPE html>
<!--
- | Generated by Apache Maven Doxia Site Renderer 1.8.1 at 2018-08-10
+ | Generated by Apache Maven Doxia Site Renderer 1.7.4 at 2018-02-21
| Rendered using Apache Maven Fluido Skin 1.6
-->
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
- <meta name="Date-Revision-yyyymmdd" content="20180810" />
+ <meta name="Date-Revision-yyyymmdd" content="20180221" />
<meta http-equiv="Content-Language" content="en" />
<title>Jackrabbit Oak – Access Control Management : The Default Implementation</title>
<link rel="stylesheet" href="../../css/apache-maven-fluido-1.6.min.css" />
@@ -52,7 +52,6 @@
<a href="#" class="dropdown-toggle" data-toggle="dropdown">Main APIs <b class="caret"></b></a>
<ul class="dropdown-menu">
<li><a href="http://www.day.com/specs/jcr/2.0/index.html" title="JCR API">JCR API</a></li>
- <li><a href="https://jackrabbit.apache.org/jcr/jcr-api.html" title="Jackrabbit API">Jackrabbit API</a></li>
<li><a href="../../oak_api/overview.html" title="Oak API">Oak API</a></li>
</ul>
</li>
@@ -137,7 +136,7 @@
<div id="breadcrumbs">
<ul class="breadcrumb">
- <li id="publishDate">Last Published: 2018-08-10<span class="divider">|</span>
+ <li id="publishDate">Last Published: 2018-02-21<span class="divider">|</span>
</li>
<li id="projectVersion">Version: 1.10-SNAPSHOT</li>
</ul>
@@ -156,14 +155,12 @@
<li><a href="../../architecture/nodestate.html" title="The Node State Model"><span class="none"></span>The Node State Model</a> </li>
<li class="nav-header">Main APIs</li>
<li><a href="http://www.day.com/specs/jcr/2.0/index.html" class="externalLink" title="JCR API"><span class="none"></span>JCR API</a> </li>
- <li><a href="https://jackrabbit.apache.org/jcr/jcr-api.html" class="externalLink" title="Jackrabbit API"><span class="none"></span>Jackrabbit API</a> </li>
<li><a href="../../oak_api/overview.html" title="Oak API"><span class="none"></span>Oak API</a> </li>
<li class="nav-header">Features and Plugins</li>
<li><a href="../../nodestore/overview.html" title="Node Storage"><span class="icon-chevron-down"></span>Node Storage</a>
<ul class="nav nav-list">
<li><a href="../../nodestore/documentmk.html" title="Document NodeStore"><span class="icon-chevron-down"></span>Document NodeStore</a>
<ul class="nav nav-list">
- <li><a href="../../nodestore/document/mongo-document-store.html" title="MongoDB DocumentStore"><span class="none"></span>MongoDB DocumentStore</a> </li>
<li><a href="../../nodestore/document/node-bundling.html" title="Node Bundling"><span class="none"></span>Node Bundling</a> </li>
<li><a href="../../nodestore/document/secondary-store.html" title="Secondary Store"><span class="none"></span>Secondary Store</a> </li>
<li><a href="../../nodestore/persistent-cache.html" title="Persistent Cache"><span class="none"></span>Persistent Cache</a> </li>
@@ -242,8 +239,7 @@
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
--->
-<div class="section">
+--><div class="section">
<h2><a name="Access_Control_Management_:_The_Default_Implementation"></a>Access Control Management : The Default Implementation</h2>
<div class="section">
<h3><a name="General"></a>General</h3>
@@ -260,32 +256,57 @@
<div class="section">
<h4><a name="Access_Control_Policies"></a>Access Control Policies</h4>
<p>The Oak access control management exposes two types of policies that cover all use case defined by the specification and required by the default setup:</p>
-<table border="0" class="table table-striped">
-<thead>
+<table border="0" class="table table-striped">
+ <thead>
+
<tr class="a">
-<th> Name </th>
-<th> Policy </th>
-<th> Description </th></tr>
-</thead><tbody>
-
-<tr class="b">
-<td> Default ACL </td>
-<td> <tt>JackrabbitAccessControlList</tt> </td>
-<td> access control on individual nodes </td></tr>
-<tr class="a">
-<td> Repo-Level ACL </td>
-<td> <tt>JackrabbitAccessControlList</tt> </td>
-<td> repo-level access control for the <tt>null</tt> path </td></tr>
-<tr class="b">
-<td> Read Policy </td>
-<td> <tt>NamedAccessControlPolicy</tt> </td>
-<td> trees that are configured to be readable to everyone </td></tr>
+
+<th>Name </th>
+
+<th>Policy </th>
+
+<th>Description </th>
+ </tr>
+ </thead>
+ <tbody>
+
+<tr class="b">
+
+<td>Default ACL </td>
+
+<td><tt>JackrabbitAccessControlList</tt> </td>
+
+<td>access control on individual nodes </td>
+ </tr>
+
+<tr class="a">
+
+<td>Repo-Level ACL </td>
+
+<td><tt>JackrabbitAccessControlList</tt> </td>
+
+<td>repo-level access control for the <tt>null</tt> path </td>
+ </tr>
+
+<tr class="b">
+
+<td>Read Policy </td>
+
+<td><tt>NamedAccessControlPolicy</tt> </td>
+
+<td>trees that are configured to be readable to everyone </td>
+ </tr>
+
<tr class="a">
+
+<td> </td>
+
<td> </td>
+
<td> </td>
-<td> </td></tr>
-</tbody>
+ </tr>
+ </tbody>
</table>
<div class="section">
<h5><a name="Default_ACL"></a>Default ACL</h5>
@@ -300,33 +321,38 @@
<h5><a name="Read_Policy"></a>Read Policy</h5>
<p>These immutable policy has been introduced in Oak 1.0 in order to allow for opening up trees that need to be readable to all sessions irrespective of other effective policies.</p>
<p>By default these policies are bound to the following trees:</p>
-<ul>
+<ul>
+
<li><tt>/jcr:system/rep:namespaces</tt>: stores all registered namespaces</li>
+
<li><tt>/jcr:system/jcr:nodeTypes</tt>: stores all registered node types</li>
+
<li><tt>/jcr:system/rep:privileges</tt>: stores all registered privileges</li>
</ul>
<p>The default set can be changed or extended by setting the corresponding configuration option. However, it is important to note that many JCR API calls rely on the accessibility of the namespace, nodetype and privilege information. Removing the corresponding paths from the configuration will most probably have undesired effects.</p></div></div>
<div class="section">
<h4><a name="Access_Control_Entries"></a>Access Control Entries</h4>
<p>The access control entries present in a given list are subject to the following rules applied upon editing but not enforced by <tt>CommitHook</tt>s:</p>
-<ul>
+<ul>
+
<li><i>uniqueness</i>: a given entry may only appear onces in a list</li>
+
<li><i>merging</i>: if an entry exists for a given principal with the same allow-status and restrictions, the existing entry will be updated without being moved in the list.</li>
+
<li><i>redundancy</i>: if an new entry makes an existing entry (partially) redundant the existing entry will be updated or removed altogether.</li>
</ul></div>
<div class="section">
<h4><a name="Restrictions"></a>Restrictions</h4>
<p>Access control entries may be created by limiting their effect by adding restrictions as mentioned by JSR 283. Details about the restriction management in Oak 1.0 as well as a list of built-in restrictions and extensibility can be found in section <a href="../authorization/restriction.html">Restriction Management</a>.</p>
-<a name="representation"></a>
-### Representation in the Repository
-
+<p><a name="representation"></a></p></div></div>
+<div class="section">
+<h3><a name="Representation_in_the_Repository"></a>Representation in the Repository</h3>
<p>All access control policies defined with an Oak repository are stores child of the node they are bound to. The node type definition used to represent access control content:</p>
-<div>
-<div>
-<pre class="source">[rep:AccessControllable]
+<div class="source">
+<div class="source"><pre class="prettyprint">[rep:AccessControllable]
mixin
+ rep:policy (rep:Policy) protected IGNORE
@@ -360,15 +386,14 @@
- * (UNDEFINED) protected
- * (UNDEFINED) protected multiple
</pre></div></div>
-
+<div class="section">
<div class="section">
<h5><a name="Examples"></a>Examples</h5>
<div class="section">
<h6><a name="Regular_ACL_at_content"></a>Regular ACL at /content</h6>
-<div>
-<div>
-<pre class="source">"": {
+<div class="source">
+<div class="source"><pre class="prettyprint">"": {
"jcr:primaryType": "rep:root",
"content": {
"jcr:primaryType": "oak:Unstructured",
@@ -392,14 +417,12 @@
}
}
}
-</pre></div></div>
-</div>
+</pre></div></div></div>
<div class="section">
<h6><a name="Repo-Level_Policy"></a>Repo-Level Policy</h6>
-<div>
-<div>
-<pre class="source">"": {
+<div class="source">
+<div class="source"><pre class="prettyprint">"": {
"jcr:primaryType": "rep:root",
"jcr:mixinTypes": "rep:RepoAccessControllable",
"rep:repoPolicy": {
@@ -411,8 +434,7 @@
}
}
}
-</pre></div></div>
-</div></div></div></div>
+</pre></div></div></div></div></div></div>
<div class="section">
<h3><a name="XML_Import"></a>XML Import</h3>
<p>As of OAK 1.0 access control content can be imported both with Session and Workspace import.</p>
@@ -421,104 +443,186 @@
<p>The different <tt>ImportBehavior</tt> flags are implemented as follows: - <tt>ABORT</tt>: throws an <tt>AccessControlException</tt> if the principal is unknown - <tt>IGNORE</tt>: ignore the entry defining the unknown principal - <tt>BESTEFFORT</tt>: import the access control entry with an unknown principal.</p>
<p>In order to get the same best effort behavior as present with Jackrabbit 2.x the configuration parameters of the <tt>AuthorizationConfiguration</tt> must contain the following entry:</p>
-<div>
-<div>
-<pre class="source">importBehavior = "besteffort"
+<div class="source">
+<div class="source"><pre class="prettyprint">importBehavior = "besteffort"
</pre></div></div>
-
<p>See also (<a class="externalLink" href="https://issues.apache.org/jira/browse/OAK-1350">OAK-1350</a>))</p>
-<a name="validation"></a>
-### Validation
-
+<p><a name="validation"></a></p></div>
+<div class="section">
+<h3><a name="Validation"></a>Validation</h3>
<p>The consistency of this content structure is asserted by a dedicated <tt>AccessControlValidator</tt>. The corresponding errors are all of type <tt>AccessControl</tt> with the following codes:</p>
-<table border="0" class="table table-striped">
-<thead>
-
-<tr class="a">
-<th> Code </th>
-<th> Message </th></tr>
-</thead><tbody>
-<tr class="b">
-<td> 0001 </td>
-<td> Generic access control violation </td></tr>
-<tr class="a">
-<td> 0002 </td>
-<td> Access control entry node expected </td></tr>
-<tr class="b">
-<td> 0003 </td>
-<td> Invalid policy name </td></tr>
-<tr class="a">
-<td> 0004 </td>
-<td> Invalid policy node: Order of children is not stable </td></tr>
-<tr class="b">
-<td> 0005 </td>
-<td> Access control policy within access control content </td></tr>
-<tr class="a">
-<td> 0006 </td>
-<td> Isolated policy node </td></tr>
-<tr class="b">
-<td> 0007 </td>
-<td> Isolated access control entry </td></tr>
-<tr class="a">
-<td> 0008 </td>
-<td> ACE without principal name </td></tr>
-<tr class="b">
-<td> 0009 </td>
-<td> ACE without privileges </td></tr>
-<tr class="a">
-<td> 0010 </td>
-<td> ACE contains invalid privilege name </td></tr>
-<tr class="b">
-<td> 0011 </td>
-<td> ACE uses abstract privilege </td></tr>
+<table border="0" class="table table-striped">
+ <thead>
+
<tr class="a">
-<td> 0012 </td>
-<td> Repository level policies defined with non-root node </td></tr>
-<tr class="b">
-<td> 0013 </td>
-<td> Duplicate ACE found in policy </td></tr>
-</tbody>
+
+<th>Code </th>
+
+<th>Message </th>
+ </tr>
+ </thead>
+ <tbody>
+
+<tr class="b">
+
+<td>0001 </td>
+
+<td>Generic access control violation </td>
+ </tr>
+
+<tr class="a">
+
+<td>0002 </td>
+
+<td>Access control entry node expected </td>
+ </tr>
+
+<tr class="b">
+
+<td>0003 </td>
+
+<td>Invalid policy name </td>
+ </tr>
+
+<tr class="a">
+
+<td>0004 </td>
+
+<td>Invalid policy node: Order of children is not stable </td>
+ </tr>
+
+<tr class="b">
+
+<td>0005 </td>
+
+<td>Access control policy within access control content </td>
+ </tr>
+
+<tr class="a">
+
+<td>0006 </td>
+
+<td>Isolated policy node </td>
+ </tr>
+
+<tr class="b">
+
+<td>0007 </td>
+
+<td>Isolated access control entry </td>
+ </tr>
+
+<tr class="a">
+
+<td>0008 </td>
+
+<td>ACE without principal name </td>
+ </tr>
+
+<tr class="b">
+
+<td>0009 </td>
+
+<td>ACE without privileges </td>
+ </tr>
+
+<tr class="a">
+
+<td>0010 </td>
+
+<td>ACE contains invalid privilege name </td>
+ </tr>
+
+<tr class="b">
+
+<td>0011 </td>
+
+<td>ACE uses abstract privilege </td>
+ </tr>
+
+<tr class="a">
+
+<td>0012 </td>
+
+<td>Repository level policies defined with non-root node </td>
+ </tr>
+
+<tr class="b">
+
+<td>0013 </td>
+
+<td>Duplicate ACE found in policy </td>
+ </tr>
+ </tbody>
</table>
-<a name="configuration"></a>
-### Configuration
-
+<p><a name="configuration"></a></p></div>
+<div class="section">
+<h3><a name="Configuration"></a>Configuration</h3>
<div class="section">
<h4><a name="Configuration_Parameters"></a>Configuration Parameters</h4>
<p>The default implementation supports the following configuration parameters:</p>
-<table border="0" class="table table-striped">
-<thead>
+<table border="0" class="table table-striped">
+ <thead>
+
<tr class="a">
-<th> Parameter </th>
-<th> Type </th>
-<th> Default </th></tr>
-</thead><tbody>
-
-<tr class="b">
-<td> <tt>PARAM_RESTRICTION_PROVIDER</tt> </td>
-<td> RestrictionProvider </td>
-<td> RestrictionProviderImpl </td></tr>
-<tr class="a">
-<td> <tt>PARAM_READ_PATHS</tt> </td>
-<td> Set<String> </td>
-<td> paths to namespace, nodetype and privilege root nodes </td></tr>
-<tr class="b">
-<td> <tt>PARAM_IMPORT_BEHAVIOR</tt> </td>
-<td> String (“abort”, “ignore”, “besteffort”) </td>
-<td> “abort” </td></tr>
+
+<th>Parameter </th>
+
+<th>Type </th>
+
+<th>Default </th>
+ </tr>
+ </thead>
+ <tbody>
+
+<tr class="b">
+
+<td><tt>PARAM_RESTRICTION_PROVIDER</tt> </td>
+
+<td>RestrictionProvider </td>
+
+<td>RestrictionProviderImpl </td>
+ </tr>
+
+<tr class="a">
+
+<td><tt>PARAM_READ_PATHS</tt> </td>
+
+<td>Set<String> </td>
+
+<td>paths to namespace, nodetype and privilege root nodes </td>
+ </tr>
+
+<tr class="b">
+
+<td><tt>PARAM_IMPORT_BEHAVIOR</tt> </td>
+
+<td>String (“abort”, “ignore”, “besteffort”) </td>
+
+<td>“abort” </td>
+ </tr>
+
<tr class="a">
+
+<td> </td>
+
<td> </td>
+
<td> </td>
-<td> </td></tr>
-</tbody>
+ </tr>
+ </tbody>
</table>
<p>Differences to Jackrabbit 2.x:</p>
-<ul>
+<ul>
+
<li>The “omit-default-permission” configuration option present with the Jackrabbit’s AccessControlProvider implementations is no longer supported with Oak.</li>
+
<li>As of OAK no extra access control content is installed by default which renders that flag superfluous.</li>
-</ul><!-- hidden references --></div></div></div>
+</ul>
+<!-- hidden references --></div></div></div>
</div>
</div>
</div>
Modified: jackrabbit/site/live/oak/docs/security/accesscontrol/differences.html
URL: http://svn.apache.org/viewvc/jackrabbit/site/live/oak/docs/security/accesscontrol/differences.html?rev=1838538&r1=1838537&r2=1838538&view=diff
==============================================================================
--- jackrabbit/site/live/oak/docs/security/accesscontrol/differences.html (original)
+++ jackrabbit/site/live/oak/docs/security/accesscontrol/differences.html Tue Aug 21 10:31:37 2018
@@ -1,13 +1,13 @@
<!DOCTYPE html>
<!--
- | Generated by Apache Maven Doxia Site Renderer 1.8.1 at 2018-08-10
+ | Generated by Apache Maven Doxia Site Renderer 1.7.4 at 2018-02-21
| Rendered using Apache Maven Fluido Skin 1.6
-->
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
- <meta name="Date-Revision-yyyymmdd" content="20180810" />
+ <meta name="Date-Revision-yyyymmdd" content="20180221" />
<meta http-equiv="Content-Language" content="en" />
<title>Jackrabbit Oak – Access Control Management : Differences wrt Jackrabbit 2.x</title>
<link rel="stylesheet" href="../../css/apache-maven-fluido-1.6.min.css" />
@@ -52,7 +52,6 @@
<a href="#" class="dropdown-toggle" data-toggle="dropdown">Main APIs <b class="caret"></b></a>
<ul class="dropdown-menu">
<li><a href="http://www.day.com/specs/jcr/2.0/index.html" title="JCR API">JCR API</a></li>
- <li><a href="https://jackrabbit.apache.org/jcr/jcr-api.html" title="Jackrabbit API">Jackrabbit API</a></li>
<li><a href="../../oak_api/overview.html" title="Oak API">Oak API</a></li>
</ul>
</li>
@@ -137,7 +136,7 @@
<div id="breadcrumbs">
<ul class="breadcrumb">
- <li id="publishDate">Last Published: 2018-08-10<span class="divider">|</span>
+ <li id="publishDate">Last Published: 2018-02-21<span class="divider">|</span>
</li>
<li id="projectVersion">Version: 1.10-SNAPSHOT</li>
</ul>
@@ -156,14 +155,12 @@
<li><a href="../../architecture/nodestate.html" title="The Node State Model"><span class="none"></span>The Node State Model</a> </li>
<li class="nav-header">Main APIs</li>
<li><a href="http://www.day.com/specs/jcr/2.0/index.html" class="externalLink" title="JCR API"><span class="none"></span>JCR API</a> </li>
- <li><a href="https://jackrabbit.apache.org/jcr/jcr-api.html" class="externalLink" title="Jackrabbit API"><span class="none"></span>Jackrabbit API</a> </li>
<li><a href="../../oak_api/overview.html" title="Oak API"><span class="none"></span>Oak API</a> </li>
<li class="nav-header">Features and Plugins</li>
<li><a href="../../nodestore/overview.html" title="Node Storage"><span class="icon-chevron-down"></span>Node Storage</a>
<ul class="nav nav-list">
<li><a href="../../nodestore/documentmk.html" title="Document NodeStore"><span class="icon-chevron-down"></span>Document NodeStore</a>
<ul class="nav nav-list">
- <li><a href="../../nodestore/document/mongo-document-store.html" title="MongoDB DocumentStore"><span class="none"></span>MongoDB DocumentStore</a> </li>
<li><a href="../../nodestore/document/node-bundling.html" title="Node Bundling"><span class="none"></span>Node Bundling</a> </li>
<li><a href="../../nodestore/document/secondary-store.html" title="Secondary Store"><span class="none"></span>Secondary Store</a> </li>
<li><a href="../../nodestore/persistent-cache.html" title="Persistent Cache"><span class="none"></span>Persistent Cache</a> </li>
@@ -242,8 +239,7 @@
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
- -->
-<div class="section">
+ --><div class="section">
<div class="section">
<h3><a name="Access_Control_Management_:_Differences_wrt_Jackrabbit_2.x"></a>Access Control Management : Differences wrt Jackrabbit 2.x</h3>
<div class="section">
@@ -255,7 +251,7 @@
<p>As of OAK those methods throw <tt>PathNotFoundException</tt> if the corresponding node is not accessible by the editing session. This is in accordance with the behavior mandated by JSR 283 and a bug in Jackrabbit 2.x.</p></div>
<div class="section">
<h6><a name="getEffectivePolicies"></a>getEffectivePolicies</h6>
-<p>In contrast to Jackrabbit 2.x the editing session is used to retrieve the effective policies and the policies returned by these methods are guarantueed to only return information that is otherwise accessible by the session. The corresponding methods in Jackrabbit 2.x use to throw an exception in this situation.</p></div></div>
+<p>In contrast to Jackrabbit 2.x the editing session is used to retrieve the effective policies and the policies returned by these methods are guarantueed to only return information that is otherwise accessible by the session. The corresponding methods in Jackrabbit 2.x use to throw an exception in this situation.</p></div></div>
<div class="section">
<h5><a name="AccessControlPolicy"></a>AccessControlPolicy</h5>
<p>OAK introduces a new type of policy that enforces regular read-access for everyone on the trees that hold this new <tt>ReadPolicy</tt> (see <a class="externalLink" href="https://issues.apache.org/jira/browse/OAK-951">OAK-951</a>). The main usage of this new policy is to ensure backwards compatible behavior of repository level information (node types, namespace, privileges) that are now kept within the content repository. In Jackrabbit 2.x this information was stored in the file system without the ability to apply or enforce regular access control such as present with items in the repository.</p>
@@ -273,28 +269,34 @@
<div class="section">
<h5><a name="Restrictions"></a>Restrictions</h5>
<p>The implementation of additional restrictions associated with an ACE has been slighly modified/extended.</p>
-<p>See section <a href="../authorization/restriction.html">Restriction Management</a> for details.</p></div>
+<p>See section <a href="../authorization/restriction.html">Restriction Management</a> for details. </p></div>
<div class="section">
<h5><a name="XML_Import"></a>XML Import</h5>
-<ul>
+<ul>
+
<li>respects <tt>ImportBehavior</tt> for handling of principals instead of just performing best effort import</li>
+
<li>supports both <tt>Workspace</tt> and <tt>Session</tt> import</li>
</ul></div></div>
<div class="section">
<h4><a name="Configuration"></a>Configuration</h4>
-<ul>
+<ul>
+
<li>The “omit-default-permission” configuration option present with the Jackrabbit’s AccessControlProvider implementations is no longer supported with Oak.</li>
+
<li>As of OAK no extra access control content is installed by default which renders that flag superfluous.</li>
</ul></div>
<div class="section">
<h4><a name="Important_Note"></a>Important Note</h4>
<p>The following modification is most likely to have an effect on existing applications:</p>
-<ul>
-<li><tt>AccessControlManager#hasPrivilege()</tt> and <tt>AccessControlManager#getPrivileges()</tt> will throw a <tt>PathNotFoundException</tt> if the node for the specified path is not accessible. The Jackrabbit 2 implementation is wrong and we fixed that in OAK (<a class="externalLink" href="https://issues.apache.org/jira/browse/OAK-886">OAK-886</a>). If the new behaviour turns out to be a problem with existing applications we might consider adding backward compatible behaviour.</li>
-</ul><!-- hidden references --></div></div></div>
+<ul>
+
+<li><tt>AccessControlManager#hasPrivilege()</tt> and <tt>AccessControlManager#getPrivileges()</tt> will throw a <tt>PathNotFoundException</tt> if the node for the specified path is not accessible. The Jackrabbit 2 implementation is wrong and we fixed that in OAK (<a class="externalLink" href="https://issues.apache.org/jira/browse/OAK-886">OAK-886</a>). If the new behaviour turns out to be a problem with existing applications we might consider adding backward compatible behaviour.</li>
+</ul>
+<!-- hidden references --></div></div></div>
</div>
</div>
</div>