+1 to enable that by default. The cases where the users really need to disabled it are very rare, if any, so turn it on shouldn't cause any problems.
El lun, 12 oct 2026 a las 10:09, Jörg Hoh via oak-dev (< [email protected]>) escribió: > Hi, > > In the AEM world I recently came across a few cases (again), that the > anonymous user was deactivated; this causes problems, as a user-admin is > able to disallow the login page from being rendered (amongst other > symptoms), which can render the entire system unavailable, and force admin > intervention. > > In OAK-10466 the feature was added to prevent this situation, that the > anonymous user is deactivated. Unfortunately this feature is turned off by > default and the anonymous user can still be disabled (see > > https://github.com/apache/jackrabbit-oak/blob/64d1e16a4828f73a5a6bc20cb429b2a13a696564/oak-core/src/main/java/org/apache/jackrabbit/oak/security/user/UserConfigurationImpl.java#L202 > ). > > I wonder if there is a general agreement to change this setting and prevent > disabling it. I don't see any potential drawback from that, in the majority > (all?) cases this user is required to be non-disabled, even if it's just > used to render the login page. > > WDYT? > > Jörg > > > -- > https://cqdump.joerghoh.de >
