You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@jackrabbit.apache.org by th...@apache.org on 2021/08/19 10:11:38 UTC
svn commit: r1892438 [2/2] - in /jackrabbit/site/live/oak/docs: ./ features/
nodestore/document/ nodestore/segment/ query/ security/
security/accesscontrol/ security/authentication/
security/authentication/external/ security/authentication/token/ secur...
Modified: jackrabbit/site/live/oak/docs/security/authorization/restriction.html
URL: http://svn.apache.org/viewvc/jackrabbit/site/live/oak/docs/security/authorization/restriction.html?rev=1892438&r1=1892437&r2=1892438&view=diff
==============================================================================
--- jackrabbit/site/live/oak/docs/security/authorization/restriction.html (original)
+++ jackrabbit/site/live/oak/docs/security/authorization/restriction.html Thu Aug 19 10:11:37 2021
@@ -1,13 +1,13 @@
<!DOCTYPE html>
<!--
- | Generated by Apache Maven Doxia Site Renderer 1.8.1 at 2021-07-05
+ | Generated by Apache Maven Doxia Site Renderer 1.8.1 at 2021-08-19
| Rendered using Apache Maven Fluido Skin 1.6
-->
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
- <meta name="Date-Revision-yyyymmdd" content="20210705" />
+ <meta name="Date-Revision-yyyymmdd" content="20210819" />
<meta http-equiv="Content-Language" content="en" />
<title>Jackrabbit Oak – Restriction Management</title>
<link rel="stylesheet" href="../../css/apache-maven-fluido-1.6.min.css" />
@@ -156,7 +156,7 @@
<div id="breadcrumbs">
<ul class="breadcrumb">
- <li id="publishDate">Last Published: 2021-07-05<span class="divider">|</span>
+ <li id="publishDate">Last Published: 2021-08-19<span class="divider">|</span>
</li>
<li id="projectVersion">Version: 1.41-SNAPSHOT</li>
</ul>
@@ -305,7 +305,7 @@
<p>[…] the permissions encompass the restrictions imposed by privileges, but also include any additional policy-internal refinements with effects too fine-grained to be exposed through privilege discovery. A common case may be to provide finer-grained access restrictions to individual properties or child nodes of the node to which the policy applies.</p>
</blockquote>
-<p>Furthermore the restriction concept is aimed to allow for custom extensions of the default access control implementation to meet project specific needs without having to implement the common functionality provided by JCR.</p>
+<p>Furthermore, the restriction concept is aimed to allow for custom extensions of the default access control implementation to meet project specific needs without having to implement the common functionality provided by JCR.</p>
<p>Existing and potential examples of restrictions limiting the effect of a given access control entry during permission evaluation include:</p>
<ul>
@@ -315,12 +315,12 @@
<li>dedicated time frame</li>
<li>size of a value</li>
</ul>
-<p>The set of built-in restrictions present with Jackrabbit 2.x has extended as of Oak 1.0 along with some extensions of the Jackrabbit API. This covers the public facing usage of restrictions i.e. access control management.</p>
-<p>In addition Oak provides it’s own restriction API that adds support for internal validation and permission evaluation.</p>
+<p>The set of built-in restrictions available with Jackrabbit 2.x has been extended along with some extensions of the Jackrabbit API. This covers the public facing usage of restrictions i.e. access control management.</p>
+<p>In addition, Oak provides its own internal restriction API that adds support for validation and permission evaluation.</p>
<p><a name="jackrabbit_api"></a></p></div>
<div class="section">
<h3><a name="Jackrabbit_API"></a>Jackrabbit API</h3>
-<p>The Jackrabbit API add the following extensions to JCR access control management to read and create entries with restrictions:</p>
+<p>The Jackrabbit API adds the following extensions to JCR access control management to read and create entries with restrictions:</p>
<ul>
<li>
@@ -329,9 +329,9 @@
<ul>
<li><tt>getRestrictionNames()</tt> : returns the JCR names of the supported restrictions.</li>
-<li><tt>getRestrictionType(String restrictionName)</tt> : returns property type of a given restriction.</li>
+<li><tt>getRestrictionType(String restrictionName)</tt> : returns the property type of a given restriction.</li>
<li><tt>addEntry(Principal, Privilege[], boolean, Map<String, Value>)</tt>: the map contain the restrictions.</li>
-<li><tt>addEntry(Principal, Privilege[], boolean, Map<String, Value>, Map<String, Value[]>)</tt>: allows to specify both single and multivalue restrictions (since Oak 1.0, Jackrabbit API 2.8)</li>
+<li><tt>addEntry(Principal, Privilege[], boolean, Map<String, Value>, Map<String, Value[]>)</tt>: allows to specify both single and multi-value restrictions (since Oak 1.0, Jackrabbit API 2.8)</li>
</ul>
</li>
<li>
@@ -365,15 +365,15 @@
<li><tt>AbstractRestrictionProvider</tt>: abstract base implementation of the provider interface.</li>
<li><tt>RestrictionDefinitionImpl</tt>: default implementation of the <tt>RestrictionDefinition</tt> interface.</li>
<li><tt>RestrictionImpl</tt>: default implementation of the <tt>Restriction</tt> interface.</li>
-<li><tt>CompositeRestrictionProvider</tt>: Allows to aggregate multiple provider implementations (see <a href="#pluggability">Pluggability</a> below).</li>
-<li><tt>CompositePattern</tt>: Allows to aggregate multiple restriction patterns.</li>
+<li><tt>CompositeRestrictionProvider</tt>: Allows aggregating multiple provider implementations (see <a href="#pluggability">Pluggability</a> below).</li>
+<li><tt>CompositePattern</tt>: Allows aggregating multiple restriction patterns.</li>
</ul>
<div class="section">
<h4><a name="Changes_wrt_Jackrabbit_2.x"></a>Changes wrt Jackrabbit 2.x</h4>
<p>Apart from the fact that the internal Jackrabbit extension has been replaced by a public API, the restriction implementation in Oak differs from Jackrabbit 2.x as follows:</p>
<ul>
-<li>Separate restriction management API (see below) on the OAK level that allows to ease plugging custom restrictions.</li>
+<li>Separate restriction management API (see below) on the OAK level that simplifies plugging custom restrictions.</li>
<li>Changed node type definition for storing restrictions in the default implementation.
<ul>
@@ -384,24 +384,64 @@
<li>Support for multi-valued restrictions (see <a class="externalLink" href="https://issues.apache.org/jira/browse/JCR-3637">JCR-3637</a>, <a class="externalLink" href="https://issues.apache.org/jira/browse/JCR-3641">JCR-3641</a>)</li>
<li>Validation of the restrictions is delegated to a dedicated commit hook</li>
<li>Restriction <tt>rep:glob</tt> limits the number of wildcard characters to 20</li>
-<li>New restrictions <tt>rep:ntNames</tt>, <tt>rep:prefixes</tt> and <tt>rep:itemNames</tt></li>
+<li>New restrictions <tt>rep:ntNames</tt>, <tt>rep:prefixes</tt>, <tt>rep:itemNames</tt> and <tt>rep:current</tt></li>
</ul></div>
<div class="section">
<h4><a name="Built-in_Restrictions"></a>Built-in Restrictions</h4>
-<p>The default implementations of the <tt>Restriction</tt> interface are present with Oak 1.0 access control management:</p>
-<ul>
+<p>The following <tt>Restriction</tt> implementations are supported with the default Oak access control management:</p>
+<table border="0" class="table table-striped">
+<thead>
-<li><tt>rep:glob</tt>: single name, path or path pattern with ‘*’ wildcard(s).</li>
-<li><tt>rep:ntNames</tt>: multivalued restriction to limit the affected ACE to nodes of the specified primary node type(s) (no nt inheritence, since Oak 1.0)</li>
-<li><tt>rep:prefixes</tt>: multivalued restriction to limit the effect to item names that match the specified namespace prefixes (session level remapping not respected, since Oak 1.0)</li>
-<li><tt>rep:itemNames</tt>: multivalued restriction for property or node names (since Oak 1.3.8)</li>
-</ul>
-<div class="section">
-<h5><a name="Examples"></a>Examples</h5>
+<tr class="a">
+<th> Restriction Name </th>
+<th> Type </th>
+<th> Multi-Valued </th>
+<th> Mandatory </th>
+<th> Description </th>
+<th> Since </th></tr>
+</thead><tbody>
+
+<tr class="b">
+<td> <tt>rep:glob</tt> </td>
+<td> String </td>
+<td> false </td>
+<td> false </td>
+<td> Single name, path or path pattern with ‘*’ wildcard(s), see below for details </td>
+<td> Oak 1.0 </td></tr>
+<tr class="a">
+<td> <tt>rep:ntNames</tt> </td>
+<td> Name </td>
+<td> true </td>
+<td> false </td>
+<td> Multivalued restriction to limit the effect to nodes of the specified primary node types (no nt inheritance) </td>
+<td> Oak 1.0 </td></tr>
+<tr class="b">
+<td> <tt>rep:prefixes</tt> </td>
+<td> String </td>
+<td> true </td>
+<td> false </td>
+<td> Multivalued restriction to limit the effect to item names that match the specified namespace prefixes (session level remapping not respected) </td>
+<td> Oak 1.0 </td></tr>
+<tr class="a">
+<td> <tt>rep:itemNames</tt> </td>
+<td> Name </td>
+<td> true </td>
+<td> false </td>
+<td> Multivalued restriction for property or node names </td>
+<td> Oak 1.3.8 </td></tr>
+<tr class="b">
+<td> <tt>rep:current</tt> </td>
+<td> String </td>
+<td> true </td>
+<td> false </td>
+<td> Multivalued restriction that limits the effect to a single level i.e. the target node where the access control entry takes effect and optionally all or a subset of it’s properties. There is no inheritance of the ACE effect to nodes in the subtree or their properties. Expanded JCR property names and namespace remapping not supported (see below for details) </td>
+<td> Oak 1.42.0 </td></tr>
+</tbody>
+</table>
<div class="section">
-<h6><a name="Using_rep:glob"></a>Using rep:glob</h6>
+<h5><a name="rep:glob_-_Details_and_Examples"></a>rep:glob - Details and Examples</h5>
<p>For a nodePath <tt>/foo</tt> the following results can be expected for the different values of <tt>rep:glob</tt>.</p>
-<p>Please note that the pattern is based on simple path concatenation and equally applies to either type of item (both nodes and properties). Consequently the examples below need to be adjusted for the root node in order to produce the desired effect. In particular a path with two subsequent / is invalid and will never match any target item or path.</p>
+<p>Please note that the pattern is based on simple path concatenation and equally applies to either type of item (both nodes and properties). Consequently, the examples below need to be adjusted for the root node in order to produce the desired effect. In particular a path with two subsequent / is invalid and will never match any target item or path.</p>
<table border="0" class="table table-striped">
<thead>
@@ -479,11 +519,50 @@
<td> all descendants of ‘/foocat’ </td></tr>
</tbody>
</table>
-<p>See also <a class="externalLink" href="https://github.com/apache/jackrabbit-oak/tree/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/restriction/GlobPattern.java?view=markup">GlobPattern</a> for implementation details and the <a class="externalLink" href="https://github.com/apache/jackrabbit-oak/tree/trunk/oak-exercise/src/test/java/org/apache/jackrabbit/oak/exercise/security/authorization/accesscontrol/L8_GlobRestrictionTest.java?view=markup">GlobRestrictionTest</a> in the <i>oak-exercise</i> module for training material.</p>
+<p>See also <a class="externalLink" href="https://github.com/apache/jackrabbit-oak/tree/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/restriction/GlobPattern.java?view=markup">GlobPattern</a> for implementation details and the <a class="externalLink" href="https://github.com/apache/jackrabbit-oak/tree/trunk/oak-exercise/src/test/java/org/apache/jackrabbit/oak/exercise/security/authorization/accesscontrol/L8_GlobRestrictionTest.java?view=markup">GlobRestrictionTest</a> in the <i>oak-exercise</i> module for training material.</p></div>
+<div class="section">
+<h5><a name="rep:current_-_Details_and_Examples"></a>rep:current - Details and Examples</h5>
+<p>The restriction limits the effect to the target node. The value of the restriction property defines which properties of the target node will in addition also match the restriction:</p>
+<ul>
+
+<li>an empty value array will make the restriction matching the target node only (i.e. equivalent to rep:glob="").</li>
+<li>an array of qualified property names will extend the effect of the restriction to properties of the target node that match the specified names.</li>
+<li>the residual name * will match all properties of the target node.</li>
+</ul>
+<p>For a nodePath <tt>/foo</tt> the following results can be expected for the different values of <tt>rep:current</tt>:</p>
+<table border="0" class="table table-striped">
+<thead>
+
+<tr class="a">
+<th> rep:current </th>
+<th> Result </th></tr>
+</thead><tbody>
+
+<tr class="b">
+<td> [] </td>
+<td> <tt>/foo</tt> only, none of it’s properties </td></tr>
+<tr class="a">
+<td> [*] </td>
+<td> <tt>/foo</tt> and all it’s properties </td></tr>
+<tr class="b">
+<td> [jcr:primaryType] </td>
+<td> <tt>/foo</tt> and it’s <tt>jcr:primaryType</tt> property. no other property </td></tr>
+<tr class="a">
+<td> [a, b, c] </td>
+<td> <tt>/foo</tt> and it’s properties <tt>a</tt>,<tt>b</tt>,<tt>c</tt> </td></tr>
+</tbody>
+</table>
+<div class="section">
+<h6><a name="Known_Limitations"></a>Known Limitations</h6>
+<ul>
+
+<li>Due to the support of the residual name <tt>*</tt>, which isn’t a valid JCR name, the restriction <tt>rep:current</tt> is defined to be of <tt>PropertyType.STRING</tt> instead of <tt>PropertyType.NAME</tt>. Like the <tt>rep:glob</tt> restriction it will therefore not work with expanded JCR names or with remapped namespace prefixes.</li>
+<li>In case of permission evaluation for a path pointing to a <i>non-existing</i> JCR item (see e.g. <tt>javax.jcr.Session#hasPermission(String, String)</tt>), it’s not possible to distinguish between nodes and properties. A best-effort approach is take to identify known properties like e.g. <tt>jcr:primaryType</tt>. For all other paths the implementation of the <tt>rep:current</tt> restrictions assumes that they point to non-existing nodes. Example: if <tt>rep:current</tt> is present with an ACE taking effect at <tt>/foo</tt> the call <tt>Session.hasPermission("/foo/non-existing",Session.ACTION_READ)</tt> will always return <tt>false</tt> because the restriction will interpret <tt>/foo/non-existing</tt> as a path pointing to a node.</li>
+</ul>
<p><a name="representation"></a></p></div></div></div></div>
<div class="section">
<h3><a name="Representation_in_the_Repository"></a>Representation in the Repository</h3>
-<p>All restrictions defined by default in a Oak repository are stored as properties in a dedicated <tt>rep:restriction</tt> child node of the target access control entry node. Similarly, they are represented with the corresponding permission entry. The node type definition used to represent restriction content is as follows:</p>
+<p>All restrictions defined by default in an Oak repository are stored as properties in a dedicated <tt>rep:restriction</tt> child node of the target access control entry node. Similarly, they are represented with the corresponding permission entry. The node type definition used to represent restriction content is as follows:</p>
<div>
<div>
@@ -507,7 +586,7 @@
<div class="section">
<h3><a name="Pluggability"></a>Pluggability</h3>
<p>The default security setup as present with Oak 1.0 is able to provide custom <tt>RestrictionProvider</tt> implementations and will automatically combine the different implementations using the <tt>CompositeRestrictionProvider</tt>.</p>
-<p>In an OSGi setup the following steps are required in order to add a action provider implementation:</p>
+<p>In an OSGi setup the following steps are required in order to add an action provider implementation:</p>
<ul>
<li>implement <tt>RestrictionProvider</tt> interface exposing your custom restriction(s).</li>
Modified: jackrabbit/site/live/oak/docs/security/overview.html
URL: http://svn.apache.org/viewvc/jackrabbit/site/live/oak/docs/security/overview.html?rev=1892438&r1=1892437&r2=1892438&view=diff
==============================================================================
--- jackrabbit/site/live/oak/docs/security/overview.html (original)
+++ jackrabbit/site/live/oak/docs/security/overview.html Thu Aug 19 10:11:37 2021
@@ -1,13 +1,13 @@
<!DOCTYPE html>
<!--
- | Generated by Apache Maven Doxia Site Renderer 1.8.1 at 2021-07-05
+ | Generated by Apache Maven Doxia Site Renderer 1.8.1 at 2021-08-19
| Rendered using Apache Maven Fluido Skin 1.6
-->
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
- <meta name="Date-Revision-yyyymmdd" content="20210705" />
+ <meta name="Date-Revision-yyyymmdd" content="20210819" />
<meta http-equiv="Content-Language" content="en" />
<title>Jackrabbit Oak – The Oak Security Layer</title>
<link rel="stylesheet" href="../css/apache-maven-fluido-1.6.min.css" />
@@ -156,7 +156,7 @@
<div id="breadcrumbs">
<ul class="breadcrumb">
- <li id="publishDate">Last Published: 2021-07-05<span class="divider">|</span>
+ <li id="publishDate">Last Published: 2021-08-19<span class="divider">|</span>
</li>
<li id="projectVersion">Version: 1.41-SNAPSHOT</li>
</ul>
Modified: jackrabbit/site/live/oak/docs/security/permission/differences.html
URL: http://svn.apache.org/viewvc/jackrabbit/site/live/oak/docs/security/permission/differences.html?rev=1892438&r1=1892437&r2=1892438&view=diff
==============================================================================
--- jackrabbit/site/live/oak/docs/security/permission/differences.html (original)
+++ jackrabbit/site/live/oak/docs/security/permission/differences.html Thu Aug 19 10:11:37 2021
@@ -1,13 +1,13 @@
<!DOCTYPE html>
<!--
- | Generated by Apache Maven Doxia Site Renderer 1.8.1 at 2021-07-05
+ | Generated by Apache Maven Doxia Site Renderer 1.8.1 at 2021-08-19
| Rendered using Apache Maven Fluido Skin 1.6
-->
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
- <meta name="Date-Revision-yyyymmdd" content="20210705" />
+ <meta name="Date-Revision-yyyymmdd" content="20210819" />
<meta http-equiv="Content-Language" content="en" />
<title>Jackrabbit Oak – Permissions : Differences wrt Jackrabbit 2.x</title>
<link rel="stylesheet" href="../../css/apache-maven-fluido-1.6.min.css" />
@@ -156,7 +156,7 @@
<div id="breadcrumbs">
<ul class="breadcrumb">
- <li id="publishDate">Last Published: 2021-07-05<span class="divider">|</span>
+ <li id="publishDate">Last Published: 2021-08-19<span class="divider">|</span>
</li>
<li id="projectVersion">Version: 1.41-SNAPSHOT</li>
</ul>
Modified: jackrabbit/site/live/oak/docs/security/permission/permissionsandprivileges.html
URL: http://svn.apache.org/viewvc/jackrabbit/site/live/oak/docs/security/permission/permissionsandprivileges.html?rev=1892438&r1=1892437&r2=1892438&view=diff
==============================================================================
--- jackrabbit/site/live/oak/docs/security/permission/permissionsandprivileges.html (original)
+++ jackrabbit/site/live/oak/docs/security/permission/permissionsandprivileges.html Thu Aug 19 10:11:37 2021
@@ -1,13 +1,13 @@
<!DOCTYPE html>
<!--
- | Generated by Apache Maven Doxia Site Renderer 1.8.1 at 2021-07-05
+ | Generated by Apache Maven Doxia Site Renderer 1.8.1 at 2021-08-19
| Rendered using Apache Maven Fluido Skin 1.6
-->
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
- <meta name="Date-Revision-yyyymmdd" content="20210705" />
+ <meta name="Date-Revision-yyyymmdd" content="20210819" />
<meta http-equiv="Content-Language" content="en" />
<title>Jackrabbit Oak – Permissions vs Privileges</title>
<link rel="stylesheet" href="../../css/apache-maven-fluido-1.6.min.css" />
@@ -156,7 +156,7 @@
<div id="breadcrumbs">
<ul class="breadcrumb">
- <li id="publishDate">Last Published: 2021-07-05<span class="divider">|</span>
+ <li id="publishDate">Last Published: 2021-08-19<span class="divider">|</span>
</li>
<li id="projectVersion">Version: 1.41-SNAPSHOT</li>
</ul>
@@ -308,7 +308,8 @@
<p>Usually it is not required for a application to check the privileges/permissions of a given session (or set of principals) as this evaluation can be left to the repository.</p>
<p>For rare cases where the application needs to understand if a given session is actually allowed to perform a given action, it is recommend to use <tt>Session.hasPermission(String, String)</tt> or <tt>JackrabbitSession.hasPermission(String, String...)</tt></p>
<p>In order to test permissions that are not reflected in the action constants defined on <tt>Session</tt> or <tt>JackrabbitSession</tt>, the default implementation also allows to pass the names of the Oak internal permission.</p>
-<p>Alternatively, <tt>AccessControlManager.hasPrivileges(String, Privilege[])</tt> can be used.</p>
+<p>To evaluate privileges granted for a given editing session <tt>AccessControlManager.hasPrivileges(String, Privilege[])</tt>, <tt>AccessControlManager.getPrivileges(String)</tt> can be used. The <tt>JackrabbitAccessControlManager</tt> defines variants of both methods that in addition take a set of <tt>Principal</tt>. If the editing session as sufficient permissions these methods can be used to evaluate/obtain privileges for a different set of principals than associated with the editing session.</p>
+<p>Since Oak 1.42.0 <tt>JackrabbitAccessControlManager</tt> defines <tt>JackrabbitAccessControlManager.getPrivilegeCollection(String)</tt> and <tt>JackrabbitAccessControlManager.getPrivilegeCollection(String, Set)</tt> which allows for efficient evaluation if a given set of privileges are granted at a given path. It allows to avoid repeated calls to <tt>hasPrivileges</tt> for the same path or manual resolution of privilege aggregation (see <a class="externalLink" href="https://issues.apache.org/jira/browse/OAK-9494">OAK-9494</a> for details).</p>
<p>The subtle differences between the permission-testing <tt>Session</tt> and the evaluation of privileges on <tt>AccessControlManager</tt> are listed below.</p></div>
<div class="section">
<h3><a name="Testing_Permissions"></a>Testing Permissions</h3>
@@ -344,6 +345,7 @@
<li><tt>AccessControlManager.hasPrivileges(String absPath, Privilege[] privileges)</tt></li>
<li><tt>AccessControlManager.getPrivileges(String absPath)</tt></li>
+<li><tt>JackrabbitAccessControlManager.getPrivilegeCollection(String absPath)</tt> followed by <tt>PrivilegeCollection.includes(String...)</tt></li>
</ul>
<p>Where</p>
<ul>
@@ -356,6 +358,7 @@
<li><tt>JackrabbitAccessControlManager.hasPrivileges(String absPath, Set<Principal> principals, Privilege[] privileges)</tt></li>
<li><tt>JackrabbitAccessControlManager.getPrivileges(String absPath, Set<Principal> principals)</tt></li>
+<li><tt>JackrabbitAccessControlManager.getPrivilegeCollection(String absPath, Set<Principal> principals)</tt> (see also section <a href="../privilege.html">Privilege Management</a>)</li>
</ul></div>
<div class="section">
<h4><a name="Characteristics"></a>Characteristics</h4>
Modified: jackrabbit/site/live/oak/docs/security/principal.html
URL: http://svn.apache.org/viewvc/jackrabbit/site/live/oak/docs/security/principal.html?rev=1892438&r1=1892437&r2=1892438&view=diff
==============================================================================
--- jackrabbit/site/live/oak/docs/security/principal.html (original)
+++ jackrabbit/site/live/oak/docs/security/principal.html Thu Aug 19 10:11:37 2021
@@ -1,13 +1,13 @@
<!DOCTYPE html>
<!--
- | Generated by Apache Maven Doxia Site Renderer 1.8.1 at 2021-07-05
+ | Generated by Apache Maven Doxia Site Renderer 1.8.1 at 2021-08-19
| Rendered using Apache Maven Fluido Skin 1.6
-->
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
- <meta name="Date-Revision-yyyymmdd" content="20210705" />
+ <meta name="Date-Revision-yyyymmdd" content="20210819" />
<meta http-equiv="Content-Language" content="en" />
<title>Jackrabbit Oak – Principal Management</title>
<link rel="stylesheet" href="../css/apache-maven-fluido-1.6.min.css" />
@@ -156,7 +156,7 @@
<div id="breadcrumbs">
<ul class="breadcrumb">
- <li id="publishDate">Last Published: 2021-07-05<span class="divider">|</span>
+ <li id="publishDate">Last Published: 2021-08-19<span class="divider">|</span>
</li>
<li id="projectVersion">Version: 1.41-SNAPSHOT</li>
</ul>
@@ -339,7 +339,7 @@
<p><a name="configuration"></a></p></div></div>
<div class="section">
<h3><a name="Configuration"></a>Configuration</h3>
-<p>The <a href="/oak/docs/apidocs/org/apache/jackrabbit/oak/spi/security/principal/PrincipalConfiguration.html">PrincipalConfiguration</a> is the Oak level entry point to obtain a new <a class="externalLink" href="http://svn.apache.org/repos/asf/jackrabbit/trunk/jackrabbit-api/src/main/java/org/apache/jackrabbit/api/security/principal/PrincipalManager.java">PrincipalManager</a> or <a href="/oak/docs/apidocs/org/apache/jackrabbit/oak/spi/security/principal/PrincipalProvider.html">PrincipalProvider</a> as well as principal related configuration options. The default implementation of the <a class="externalLink" href="http://svn.apache.org/repos/asf/jackrabbit/trunk/jackrabbit-api/src/main/java/org/apache/jackrabbit/api/security/principal/PrincipalManager.java">PrincipalManager</a> interface is based on Oak API and can equally be used for privilege related tasks in the Oak layer.</p>
+<p>The <a href="/oak/docs/apidocs/org/apache/jackrabbit/oak/spi/security/principal/PrincipalConfiguration.html">PrincipalConfiguration</a> is the Oak level entry point to obtain a new <a href="/oak/docs/apidocs/org/apache/jackrabbit/api/security/principal/PrincipalManager.html">PrincipalManager</a> or <a href="/oak/docs/apidocs/org/apache/jackrabbit/oak/spi/security/principal/PrincipalProvider.html">PrincipalProvider</a> as well as principal related configuration options. The default implementation of the <a href="/oak/docs/apidocs/org/apache/jackrabbit/api/security/principal/PrincipalManager.html">PrincipalManager</a> interface is based on Oak API and can equally be used for privilege related tasks in the Oak layer.</p>
<p>In contrast to Jackrabbit 2.x the system may only have one single principal provider implementation configured. In order to combine principals from different sources a implementation that properly handles the different sources is required; the <a href="/oak/docs/apidocs/org/apache/jackrabbit/oak/spi/security/principal/CompositePrincipalProvider.html">CompositePrincipalProvider</a> is an example that combines multiple implementations.</p>
<p><a name="pluggability"></a></p></div>
<div class="section">
Modified: jackrabbit/site/live/oak/docs/security/principal/differences.html
URL: http://svn.apache.org/viewvc/jackrabbit/site/live/oak/docs/security/principal/differences.html?rev=1892438&r1=1892437&r2=1892438&view=diff
==============================================================================
--- jackrabbit/site/live/oak/docs/security/principal/differences.html (original)
+++ jackrabbit/site/live/oak/docs/security/principal/differences.html Thu Aug 19 10:11:37 2021
@@ -1,13 +1,13 @@
<!DOCTYPE html>
<!--
- | Generated by Apache Maven Doxia Site Renderer 1.8.1 at 2021-07-05
+ | Generated by Apache Maven Doxia Site Renderer 1.8.1 at 2021-08-19
| Rendered using Apache Maven Fluido Skin 1.6
-->
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
- <meta name="Date-Revision-yyyymmdd" content="20210705" />
+ <meta name="Date-Revision-yyyymmdd" content="20210819" />
<meta http-equiv="Content-Language" content="en" />
<title>Jackrabbit Oak – Principal Management : Differences wrt Jackrabbit 2.x</title>
<link rel="stylesheet" href="../../css/apache-maven-fluido-1.6.min.css" />
@@ -156,7 +156,7 @@
<div id="breadcrumbs">
<ul class="breadcrumb">
- <li id="publishDate">Last Published: 2021-07-05<span class="divider">|</span>
+ <li id="publishDate">Last Published: 2021-08-19<span class="divider">|</span>
</li>
<li id="projectVersion">Version: 1.41-SNAPSHOT</li>
</ul>
@@ -294,7 +294,7 @@
<p>As of Oak 1.0 the following interfaces and class that were internal to Jackrabbit have been made part of public API exposed by Oak:</p>
<ul>
-<li><a class="externalLink" href="http://svn.apache.org/repos/asf/jackrabbit/trunk/jackrabbit-api/src/main/java/org/apache/jackrabbit/api/security/principal/PrincipalManager.java">org.apache.jackrabbit.oak.spi.security.principal.PrincipalProvider</a>: corresponds to o.a.j.core.security.principal.PrincipalProvider</li>
+<li><a href="/oak/docs/apidocs/org/apache/jackrabbit/oak/spi/security/principal/PrincipalProvider.html">org.apache.jackrabbit.oak.spi.security.principal.PrincipalProvider</a>: corresponds to o.a.j.core.security.principal.PrincipalProvider</li>
<li><a href="/oak/docs/apidocs/org/apache/jackrabbit/oak/spi/security/principal/AdminPrincipal.html">org.apache.jackrabbit.oak.spi.security.principal.AdminPrincipal</a>: corresponds to o.a.j.core.security.principal.AdminPrincipal</li>
<li><a href="/oak/docs/apidocs/org/apache/jackrabbit/oak/spi/security/principal/EveryonePrincipal.html">org.apache.jackrabbit.oak.spi.security.principal.EveryonePrincipal</a>: corresponds to o.a.j.core.security.principal.EveryonePrincipal</li>
<li><a href="/oak/docs/apidocs/org/apache/jackrabbit/oak/spi/security/principal/SystemPrincipal.html">org.apache.jackrabbit.oak.spi.security.principal.SystemPrincipal</a>: corresponds to o.a.j.core.security.SystemPrincipal</li>
Modified: jackrabbit/site/live/oak/docs/security/principal/principalprovider.html
URL: http://svn.apache.org/viewvc/jackrabbit/site/live/oak/docs/security/principal/principalprovider.html?rev=1892438&r1=1892437&r2=1892438&view=diff
==============================================================================
--- jackrabbit/site/live/oak/docs/security/principal/principalprovider.html (original)
+++ jackrabbit/site/live/oak/docs/security/principal/principalprovider.html Thu Aug 19 10:11:37 2021
@@ -1,13 +1,13 @@
<!DOCTYPE html>
<!--
- | Generated by Apache Maven Doxia Site Renderer 1.8.1 at 2021-07-05
+ | Generated by Apache Maven Doxia Site Renderer 1.8.1 at 2021-08-19
| Rendered using Apache Maven Fluido Skin 1.6
-->
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
- <meta name="Date-Revision-yyyymmdd" content="20210705" />
+ <meta name="Date-Revision-yyyymmdd" content="20210819" />
<meta http-equiv="Content-Language" content="en" />
<title>Jackrabbit Oak – Implementations of the PrincipalProvider Interface</title>
<link rel="stylesheet" href="../../css/apache-maven-fluido-1.6.min.css" />
@@ -156,7 +156,7 @@
<div id="breadcrumbs">
<ul class="breadcrumb">
- <li id="publishDate">Last Published: 2021-07-05<span class="divider">|</span>
+ <li id="publishDate">Last Published: 2021-08-19<span class="divider">|</span>
</li>
<li id="projectVersion">Version: 1.41-SNAPSHOT</li>
</ul>
Modified: jackrabbit/site/live/oak/docs/security/privilege.html
URL: http://svn.apache.org/viewvc/jackrabbit/site/live/oak/docs/security/privilege.html?rev=1892438&r1=1892437&r2=1892438&view=diff
==============================================================================
--- jackrabbit/site/live/oak/docs/security/privilege.html (original)
+++ jackrabbit/site/live/oak/docs/security/privilege.html Thu Aug 19 10:11:37 2021
@@ -1,13 +1,13 @@
<!DOCTYPE html>
<!--
- | Generated by Apache Maven Doxia Site Renderer 1.8.1 at 2021-07-05
+ | Generated by Apache Maven Doxia Site Renderer 1.8.1 at 2021-08-19
| Rendered using Apache Maven Fluido Skin 1.6
-->
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
- <meta name="Date-Revision-yyyymmdd" content="20210705" />
+ <meta name="Date-Revision-yyyymmdd" content="20210819" />
<meta http-equiv="Content-Language" content="en" />
<title>Jackrabbit Oak – Privilege Management</title>
<link rel="stylesheet" href="../css/apache-maven-fluido-1.6.min.css" />
@@ -156,7 +156,7 @@
<div id="breadcrumbs">
<ul class="breadcrumb">
- <li id="publishDate">Last Published: 2021-07-05<span class="divider">|</span>
+ <li id="publishDate">Last Published: 2021-08-19<span class="divider">|</span>
</li>
<li id="projectVersion">Version: 1.41-SNAPSHOT</li>
</ul>
@@ -324,7 +324,7 @@
<p>Privilege management is outside of the scope provided by JCR and therefore provided by the extensions defined by the Jackrabbit API. It consists of a single interface:</p>
<ul>
-<li><a class="externalLink" href="http://svn.apache.org/repos/asf/jackrabbit/trunk/jackrabbit-api/src/main/java/org/apache/jackrabbit/api/security/authorization/PrivilegeManager.java">PrivilegeManager</a>: privilege discovery and registration of new custom privileges.
+<li><a href="/oak/docs/apidocs/org/apache/jackrabbit/api/security/authorization/PrivilegeManager.java">PrivilegeManager</a>: privilege discovery and registration of new custom privileges.
<ul>
<li><tt>getRegisteredPrivileges()</tt></li>
@@ -332,6 +332,7 @@
<li>`registerPrivilege(String, boolean, String[])</li>
</ul>
</li>
+<li><a href="/oak/docs/apidocs/org/apache/jackrabbit/api/security/authorization/PrivilegeCollection.java">PrivilegeCollection</a>: Wraps around a set of privileges allowing for testing if one or multiple privilege names are part of the given set without having to manually resolve the aggregation. Since Oak 1.42.0. For additional details see <a class="externalLink" href="https://issues.apache.org/jira/browse/OAK-9494">OAK-9494</a> as well as <tt>JackrabbitAccessControlManager.getPrivilegeCollection(String)</tt> and <tt>JackrabbitAccessControlManager.getPrivilegeCollection(String,Set)</tt>.</li>
</ul>
<div class="section">
<div class="section">
Modified: jackrabbit/site/live/oak/docs/security/privilege/mappingtoprivileges.html
URL: http://svn.apache.org/viewvc/jackrabbit/site/live/oak/docs/security/privilege/mappingtoprivileges.html?rev=1892438&r1=1892437&r2=1892438&view=diff
==============================================================================
--- jackrabbit/site/live/oak/docs/security/privilege/mappingtoprivileges.html (original)
+++ jackrabbit/site/live/oak/docs/security/privilege/mappingtoprivileges.html Thu Aug 19 10:11:37 2021
@@ -1,13 +1,13 @@
<!DOCTYPE html>
<!--
- | Generated by Apache Maven Doxia Site Renderer 1.8.1 at 2021-07-05
+ | Generated by Apache Maven Doxia Site Renderer 1.8.1 at 2021-08-19
| Rendered using Apache Maven Fluido Skin 1.6
-->
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
- <meta name="Date-Revision-yyyymmdd" content="20210705" />
+ <meta name="Date-Revision-yyyymmdd" content="20210819" />
<meta http-equiv="Content-Language" content="en" />
<title>Jackrabbit Oak – Privilege Management : Mapping API Calls to Privileges</title>
<link rel="stylesheet" href="../../css/apache-maven-fluido-1.6.min.css" />
@@ -156,7 +156,7 @@
<div id="breadcrumbs">
<ul class="breadcrumb">
- <li id="publishDate">Last Published: 2021-07-05<span class="divider">|</span>
+ <li id="publishDate">Last Published: 2021-08-19<span class="divider">|</span>
</li>
<li id="projectVersion">Version: 1.41-SNAPSHOT</li>
</ul>
Modified: jackrabbit/site/live/oak/docs/security/reports.html
URL: http://svn.apache.org/viewvc/jackrabbit/site/live/oak/docs/security/reports.html?rev=1892438&r1=1892437&r2=1892438&view=diff
==============================================================================
--- jackrabbit/site/live/oak/docs/security/reports.html (original)
+++ jackrabbit/site/live/oak/docs/security/reports.html Thu Aug 19 10:11:37 2021
@@ -1,13 +1,13 @@
<!DOCTYPE html>
<!--
- | Generated by Apache Maven Doxia Site Renderer 1.8.1 at 2021-07-05
+ | Generated by Apache Maven Doxia Site Renderer 1.8.1 at 2021-08-19
| Rendered using Apache Maven Fluido Skin 1.6
-->
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
- <meta name="Date-Revision-yyyymmdd" content="20210705" />
+ <meta name="Date-Revision-yyyymmdd" content="20210819" />
<meta http-equiv="Content-Language" content="en" />
<title>Jackrabbit Oak – Security Reports</title>
<link rel="stylesheet" href="../css/apache-maven-fluido-1.6.min.css" />
@@ -156,7 +156,7 @@
<div id="breadcrumbs">
<ul class="breadcrumb">
- <li id="publishDate">Last Published: 2021-07-05<span class="divider">|</span>
+ <li id="publishDate">Last Published: 2021-08-19<span class="divider">|</span>
</li>
<li id="projectVersion">Version: 1.41-SNAPSHOT</li>
</ul>
Modified: jackrabbit/site/live/oak/docs/security/user.html
URL: http://svn.apache.org/viewvc/jackrabbit/site/live/oak/docs/security/user.html?rev=1892438&r1=1892437&r2=1892438&view=diff
==============================================================================
--- jackrabbit/site/live/oak/docs/security/user.html (original)
+++ jackrabbit/site/live/oak/docs/security/user.html Thu Aug 19 10:11:37 2021
@@ -1,13 +1,13 @@
<!DOCTYPE html>
<!--
- | Generated by Apache Maven Doxia Site Renderer 1.8.1 at 2021-07-05
+ | Generated by Apache Maven Doxia Site Renderer 1.8.1 at 2021-08-19
| Rendered using Apache Maven Fluido Skin 1.6
-->
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
- <meta name="Date-Revision-yyyymmdd" content="20210705" />
+ <meta name="Date-Revision-yyyymmdd" content="20210819" />
<meta http-equiv="Content-Language" content="en" />
<title>Jackrabbit Oak – User Management</title>
<link rel="stylesheet" href="../css/apache-maven-fluido-1.6.min.css" />
@@ -156,7 +156,7 @@
<div id="breadcrumbs">
<ul class="breadcrumb">
- <li id="publishDate">Last Published: 2021-07-05<span class="divider">|</span>
+ <li id="publishDate">Last Published: 2021-08-19<span class="divider">|</span>
</li>
<li id="projectVersion">Version: 1.41-SNAPSHOT</li>
</ul>
Modified: jackrabbit/site/live/oak/docs/security/user/authorizableaction.html
URL: http://svn.apache.org/viewvc/jackrabbit/site/live/oak/docs/security/user/authorizableaction.html?rev=1892438&r1=1892437&r2=1892438&view=diff
==============================================================================
--- jackrabbit/site/live/oak/docs/security/user/authorizableaction.html (original)
+++ jackrabbit/site/live/oak/docs/security/user/authorizableaction.html Thu Aug 19 10:11:37 2021
@@ -1,13 +1,13 @@
<!DOCTYPE html>
<!--
- | Generated by Apache Maven Doxia Site Renderer 1.8.1 at 2021-07-05
+ | Generated by Apache Maven Doxia Site Renderer 1.8.1 at 2021-08-19
| Rendered using Apache Maven Fluido Skin 1.6
-->
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
- <meta name="Date-Revision-yyyymmdd" content="20210705" />
+ <meta name="Date-Revision-yyyymmdd" content="20210819" />
<meta http-equiv="Content-Language" content="en" />
<title>Jackrabbit Oak – Authorizable Actions</title>
<link rel="stylesheet" href="../../css/apache-maven-fluido-1.6.min.css" />
@@ -156,7 +156,7 @@
<div id="breadcrumbs">
<ul class="breadcrumb">
- <li id="publishDate">Last Published: 2021-07-05<span class="divider">|</span>
+ <li id="publishDate">Last Published: 2021-08-19<span class="divider">|</span>
</li>
<li id="projectVersion">Version: 1.41-SNAPSHOT</li>
</ul>
Modified: jackrabbit/site/live/oak/docs/security/user/membership.html
URL: http://svn.apache.org/viewvc/jackrabbit/site/live/oak/docs/security/user/membership.html?rev=1892438&r1=1892437&r2=1892438&view=diff
==============================================================================
--- jackrabbit/site/live/oak/docs/security/user/membership.html (original)
+++ jackrabbit/site/live/oak/docs/security/user/membership.html Thu Aug 19 10:11:37 2021
@@ -1,13 +1,13 @@
<!DOCTYPE html>
<!--
- | Generated by Apache Maven Doxia Site Renderer 1.8.1 at 2021-07-05
+ | Generated by Apache Maven Doxia Site Renderer 1.8.1 at 2021-08-19
| Rendered using Apache Maven Fluido Skin 1.6
-->
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
- <meta name="Date-Revision-yyyymmdd" content="20210705" />
+ <meta name="Date-Revision-yyyymmdd" content="20210819" />
<meta http-equiv="Content-Language" content="en" />
<title>Jackrabbit Oak – Group Membership</title>
<link rel="stylesheet" href="../../css/apache-maven-fluido-1.6.min.css" />
@@ -156,7 +156,7 @@
<div id="breadcrumbs">
<ul class="breadcrumb">
- <li id="publishDate">Last Published: 2021-07-05<span class="divider">|</span>
+ <li id="publishDate">Last Published: 2021-08-19<span class="divider">|</span>
</li>
<li id="projectVersion">Version: 1.41-SNAPSHOT</li>
</ul>
@@ -307,7 +307,7 @@
<li>
-<p><a class="externalLink" href="http://svn.apache.org/repos/asf/jackrabbit/trunk/jackrabbit-api/src/main/java/org/apache/jackrabbit/api/security/user/Group.java">org.apache.jackrabbit.api.security.user.Group</a></p>
+<p><a href="/oak/docs/apidocs/org/apache/jackrabbit/api/security/user/Group.html">org.apache.jackrabbit.api.security.user.Group</a></p>
<ul>
<li><tt>getDeclaredMembers() Iterator<Authorizable></tt></li>
@@ -322,7 +322,7 @@
</li>
<li>
-<p><a class="externalLink" href="http://svn.apache.org/repos/asf/jackrabbit/trunk/jackrabbit-api/src/main/java/org/apache/jackrabbit/api/security/user/Authorizable.java">org.apache.jackrabbit.api.security.user.Authorizable</a></p>
+<p><a href="/oak/docs/apidocs/org/apache/jackrabbit/api/security/user/Authorizable.html">org.apache.jackrabbit.api.security.user.Authorizable</a></p>
<ul>
<li><tt>declaredMemberOf() Iterator<Group></tt></li>
Modified: jackrabbit/site/live/oak/docs/security/user/query.html
URL: http://svn.apache.org/viewvc/jackrabbit/site/live/oak/docs/security/user/query.html?rev=1892438&r1=1892437&r2=1892438&view=diff
==============================================================================
--- jackrabbit/site/live/oak/docs/security/user/query.html (original)
+++ jackrabbit/site/live/oak/docs/security/user/query.html Thu Aug 19 10:11:37 2021
@@ -1,13 +1,13 @@
<!DOCTYPE html>
<!--
- | Generated by Apache Maven Doxia Site Renderer 1.8.1 at 2021-07-05
+ | Generated by Apache Maven Doxia Site Renderer 1.8.1 at 2021-08-19
| Rendered using Apache Maven Fluido Skin 1.6
-->
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
- <meta name="Date-Revision-yyyymmdd" content="20210705" />
+ <meta name="Date-Revision-yyyymmdd" content="20210819" />
<meta http-equiv="Content-Language" content="en" />
<title>Jackrabbit Oak – Searching Users and Groups</title>
<link rel="stylesheet" href="../../css/apache-maven-fluido-1.6.min.css" />
@@ -156,7 +156,7 @@
<div id="breadcrumbs">
<ul class="breadcrumb">
- <li id="publishDate">Last Published: 2021-07-05<span class="divider">|</span>
+ <li id="publishDate">Last Published: 2021-08-19<span class="divider">|</span>
</li>
<li id="projectVersion">Version: 1.41-SNAPSHOT</li>
</ul>
@@ -322,8 +322,8 @@ Authorizable everyoneGroup = userManager
<h3><a name="The_Query_API"></a>The Query API</h3>
<ul>
-<li><a class="externalLink" href="http://svn.apache.org/repos/asf/jackrabbit/trunk/jackrabbit-api/src/main/java/org/apache/jackrabbit/api/security/user/Query.java">Query</a>: The query object passed to the findAuthorizable method. It has a single <tt>build(QueryBuilder)</tt> method.</li>
-<li><a class="externalLink" href="http://svn.apache.org/repos/asf/jackrabbit/trunk/jackrabbit-api/src/main/java/org/apache/jackrabbit/api/security/user/QueryBuilder.java">QueryBuilder</a>: The query builder as described below.</li>
+<li><a href="/oak/docs/apidocs/org/apache/jackrabbit/api/security/user/Query.html">Query</a>: The query object passed to the findAuthorizable method. It has a single <tt>build(QueryBuilder)</tt> method.</li>
+<li><a href="/oak/docs/apidocs/org/apache/jackrabbit/api/security/user/QueryBuilder.html">QueryBuilder</a>: The query builder as described below.</li>
</ul>
<div class="section">
<h4><a name="QueryBuilder"></a>QueryBuilder</h4>