[
https://issues.apache.org/jira/browse/SLING-1110?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12756260#action_12756260
]
Ian Boston commented on SLING-1110:
-----------------------------------
------------------- from the thread--------------------------
However, after sleeping on the issue, I am not certain that the changes achieve
the desired results.
the AMP can express an opinion at the item level, but in order for it to be
really useful I think it needs to express an opinion at the ACL level. I will
try and explain in as few words as possible.
In the DefaultAccessManager (DAM) the effective ACL, bound to the set of
principals associated with the user is constructed by a hierarchical search, if
the AMP desires to make decisions compatible with principal bound ACL's (IMHO,
it does) then it will need to be able to construct the ACL.
Consequently the patch in SLING-1110 is moot, although it allows the AMP to
delegate to the DAM, it wont remove the need to duplicate the ACL construction
code in the DAM, and so the patch doesn't actually address the fundamental use
case, which IMHO is to plug in access control customizations on a user-item
basis compatible with the DAM and ACL based access control in Jackrabbit 1.5
and critically in Jackrabbit 2.
At the moment this issue is, "do nothing and think again"
---------------------------------------------------------------------
Ian
> DefaultPluggableAccessManager is all or nothing with AccessManagerPlugin
> implementations
> -----------------------------------------------------------------------------------------
>
> Key: SLING-1110
> URL: https://issues.apache.org/jira/browse/SLING-1110
> Project: Sling
> Issue Type: Bug
> Components: JCR
> Affects Versions: JCR Jackrabbit Server 2.0.4
> Reporter: Ian Boston
> Assignee: Ian Boston
> Attachments: SLING-1110.diff
>
>
> If there is a AccessManagerPlugin then it must handle all access control
> assertions, making the implementation of the plugin hard. It would be better
> if the AMP can return null to indicate that it cant handle the assertion.
> Discussed at http://markmail.org/thread/4ym7eh4xsocbev37
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
