You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@jackrabbit.apache.org by kw...@apache.org on 2022/10/06 14:52:52 UTC
[jackrabbit-filevault] branch feature/doc-authorizables-and-acls created (now 2db2e0bc)
This is an automated email from the ASF dual-hosted git repository.
kwin pushed a change to branch feature/doc-authorizables-and-acls
in repository https://gitbox.apache.org/repos/asf/jackrabbit-filevault.git
at 2db2e0bc JCRVLT-661 Document how authorizables and acls are exported/imported
This branch includes the following new commits:
new 2db2e0bc JCRVLT-661 Document how authorizables and acls are exported/imported
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
[jackrabbit-filevault] 01/01: JCRVLT-661 Document how authorizables and acls are exported/imported
Posted by kw...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
kwin pushed a commit to branch feature/doc-authorizables-and-acls
in repository https://gitbox.apache.org/repos/asf/jackrabbit-filevault.git
commit 2db2e0bc9b9b0145c19295650e2220744ffd513f
Author: Konrad Windszus <kw...@apache.org>
AuthorDate: Thu Oct 6 16:52:45 2022 +0200
JCRVLT-661 Document how authorizables and acls are exported/imported
---
src/site/markdown/acls.md | 48 ++++++++++++++++++++++++++++++++++++++
src/site/markdown/authorizables.md | 36 ++++++++++++++++++++++++++++
src/site/site.xml | 7 ++++--
3 files changed, 89 insertions(+), 2 deletions(-)
diff --git a/src/site/markdown/acls.md b/src/site/markdown/acls.md
new file mode 100644
index 00000000..bfaf7c65
--- /dev/null
+++ b/src/site/markdown/acls.md
@@ -0,0 +1,48 @@
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements. See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+
+Access Control Lists
+=================
+
+<!-- MACRO{toc} -->
+
+Overview
+----------
+
+JCR 2.0 manages the authorization in form of [Access Control Lists (ACLs)][jcr-acls]. Similar as for [authorizables](authorizables.html) the specification does not actually define how ACLs are persisted but only defines an [API][jcr-acl-api] on top of it.
+However, both Jackrabbit and Oak store authorization information inside the JCR. The following formats are supported by FileVault with these JCR implementations. For all of them the export uses [enhanced FileVault DocView format](docview.html) based on the internal repository representation, while the import uses JCR ACL API to manually import them based on the DocView format.
+
+Standard ACLs
+---------------------
+
+The standard ACLs are stored in a node named `rep:policy` below the node to which they apply. Alternatively, they are stored in a node `repo:policy` on the top level for repository level policies. The detailed format is outlined at <https://jackrabbit.apache.org/oak/docs/security/accesscontrol/default.html#representation-in-the-repository>. They are supported by both Oak and Jackrabbit.
+
+Closed User Groups (CUGs)
+-------------------
+
+The CUG ACLs are stored in a node named `cug:policy` below the node to which they apply. They are only supported in Oak.
+The detailed format is outlined at <https://jackrabbit.apache.org/oak/docs/security/authorization/cug.html#representation-in-the-repository>.
+
+Principal Based ACLs
+--------------------
+
+The principal based ACLs are stored in a node named `rep:principalPolicy` separate from the node to which they apply. The exact location depends on the implementation. They are only supported in Oak.
+The detailed format is outlined at <https://jackrabbit.apache.org/oak/docs/security/authorization/principalbased.html#representation-in-the-repository>.
+
+
+[jcr-acls]: https://s.apache.org/jcr-2.0-spec/16_Access_Control_Management.html
+[jcr-acl-api]: https://s.apache.org/jcr-2.0-spec/16_Access_Control_Management.html#16.5%20Access%20Control%20Lists
diff --git a/src/site/markdown/authorizables.md b/src/site/markdown/authorizables.md
new file mode 100644
index 00000000..abd1600c
--- /dev/null
+++ b/src/site/markdown/authorizables.md
@@ -0,0 +1,36 @@
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements. See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+
+Authorizables
+=================
+
+<!-- MACRO{toc} -->
+
+Overview
+----------
+
+JCR 2.0 does not actually define how authorizables are persisted.
+However, both Jackrabbit and Oak store them inside the JCR. The following formats are supported by FileVault with these JCR implementations.
+
+Users/Groups
+---------------------
+
+Both JCR users and groups are stored in a node of type `rep:User` and `rep:Group` respectively. The detailed format is outlined at <https://jackrabbit.apache.org/oak/docs/security/user/default.html#representation-in-the-repository>.
+Those nodes are exported in [enhanced FileVault DocView format](docview.html).
+During import the DocView XML is converted to [System View][jcr-sysview] and then imported via regular JCR means.
+
+[jcr-sysview]: https://s.apache.org/jcr-2.0-spec/7_Export.html#7.2%20System%20View
\ No newline at end of file
diff --git a/src/site/site.xml b/src/site/site.xml
index 606bfa91..a07e5e09 100644
--- a/src/site/site.xml
+++ b/src/site/site.xml
@@ -24,8 +24,11 @@
<menu name="Overview">
<item href="index.html" name="Welcome" />
<item href="overview.html" name="Architecture Overview" />
- <item href="vaultfs.html" name="Vault FS" />
- <item href="docview.html" name="Document View" />
+ <item href="vaultfs.html" name="Vault FS" >
+ <item href="docview.html" name="Document View" />
+ <item href="authorizables.html" name="Authorizables" />
+ <item href="acls.html" name="Access Control Lists" />
+ </item>
<item href="validation.html" name="Validation" />
</menu>
<menu name="Usage">