Hi, In the AEM world I recently came across a few cases (again), that the anonymous user was deactivated; this causes problems, as a user-admin is able to disallow the login page from being rendered (amongst other symptoms), which can render the entire system unavailable, and force admin intervention.
In OAK-10466 the feature was added to prevent this situation, that the anonymous user is deactivated. Unfortunately this feature is turned off by default and the anonymous user can still be disabled (see https://github.com/apache/jackrabbit-oak/blob/64d1e16a4828f73a5a6bc20cb429b2a13a696564/oak-core/src/main/java/org/apache/jackrabbit/oak/security/user/UserConfigurationImpl.java#L202 ). I wonder if there is a general agreement to change this setting and prevent disabling it. I don't see any potential drawback from that, in the majority (all?) cases this user is required to be non-disabled, even if it's just used to render the login page. WDYT? Jörg -- https://cqdump.joerghoh.de
