[
https://issues.apache.org/jira/browse/SLING-11160?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17499477#comment-17499477
]
Angela Schreiber commented on SLING-11160:
------------------------------------------
[~bdelacretaz], i adjusted the PRs according to the discussion. there is one
thing though that would like to point out to: 'remove ACL' might actually be
confusing itself, because what we actually want to achieve is removal of one or
multiple access control entries and NOT the removal of the access control list
(which in JCR is represented by {{AccessControlManager.removePolicy}} (as
opposite to {{AccessControlManager.setPolicy}}) when the corresponding call in
repo-init is named {{delete ACL}}.
in other words: removing individual access control entries is still part of a
{{AccessControlManager.setPolicy}} call because the associated policy is
written back after removing the entry.... that's my my original suggestion was
to incorporate it in the 'set ACL' blocks.
i don't have a strong preference but wanted to highlight the fact that it's not
really a remove-acl statement but rather a remove-aces....
wdyt?
> Repoinit does not allow to remove individual ACEs
> -------------------------------------------------
>
> Key: SLING-11160
> URL: https://issues.apache.org/jira/browse/SLING-11160
> Project: Sling
> Issue Type: Bug
> Components: Repoinit
> Reporter: Angela Schreiber
> Assignee: Angela Schreiber
> Priority: Major
> Attachments: SLING-11160-initial-draft.patch
>
> Time Spent: 0.5h
> Remaining Estimate: 0h
>
> With SLING-9090 support for using _REMOVE *_ for all entries at a given path
> or for a given principal has been implemented.
> However as indicated in the same issue the intended usage of _REMOVE
> some-thing-specific_ is not clear.
> What is therefore missing with repo-init is the ability to remove a single
> access control entry that matches
> - prinicipal
> - privileges
> - allow-status
> - single value restriction
> - mv restrictions.
> As far as I can see the biggest issue is the fact that REMOVE vs ALLOW/DENY
> are mutually exclusive as the other params listed above can be extracted from
> a given AclLine in combination with the set-ACL statement.
> This could be fixed by adjusting the following parser method
> {code}
> AclLine privilegesLineOperation() :
> {}
> {
> (
> <REMOVE> { return new AclLine(AclLine.Action.REMOVE); }
> | ( <ALLOW> { return new AclLine(AclLine.Action.ALLOW); } )
> | ( <DENY> { return new AclLine(AclLine.Action.DENY); } )
> )
> }
> {code}
> such that
> - REMOVE is optional, followed by
> - ALLOW or DENY
> The {{AclLine}} would then need to be slightly adjusted such that REMOVE can
> be combined with either ALLOW or DENY.
> Otherwise, I don't see how
> {{AccessControlList.removeAccessControlEntry(AccessControlEntry)}} could be
> implemented in org.apache.sling.jcr.repoinit for a single ACE.
> Or maybe the intention was something different in the first place?
> [~bdelacretaz], I would appreciate if you had time to comment on this.
> cc: [~kpauls], [~cziegeler]
--
This message was sent by Atlassian Jira
(v8.20.1#820001)
