jsedding commented on PR #44:
URL:
https://github.com/apache/sling-org-apache-sling-jcr-repoinit/pull/44#issuecomment-1774831090
@kwin I agree in principal with the idea of repoinit being a declarative
language.
Unfortunately, repoinit does not seem to have been designed and implemented
to be purely declarative. "create group", "set ACL" and "delete group" all
evoke the idea of an action, not a state. Your recent change introducing the
statement "ensure ACL" is probably rather an exception.
Therefore, I was still surprised to find that repoinit statements were being
reordered. IMHO much of the reordering was also left to chance.
The problem that lead me to this change is the goal, to set up ACLs during
initial deployment, for a group that is expected to later be sync'ed on demand
from an external identity provider (e.g. LDAP).
One possible solution to this problem is setting up ACLs with a principal
name that does not (yet) exist (hence SLING-12115). As a workaround for
SLING-12115, I devised the example using "create group", followed by "set ACL"
and finally "delete group", which fails due to the reordering of statements.
Another possible solution I experimented with is creating the group with the
correct value of the property `rep:externalId` set, effectively pre-creating
the group that would later be sync'ed. This property can **only** be set when
the group is being created. See below:
```
create group fooBar
set properties on authorizable(foobar)
set rep:externalId to "fooBar;ldap"
end
```
I have not yet managed to reproduce this issue in a unit test, because it
requires a the repository to be set up with external authentication support.
However, the above example does not work without this fix, and I have had
success using it with the fix applied. Declarative or not, I would argue that
the above example should succeed, even though they require ordering.
In order for this setup to be independent of ordering, both statements would
need to be collapsed into one, like e.g. this:
```
ensure group with properties
rep:externalId = "fooBar;ldap"
end
```
The implementation would then need to delete and recreate the group if the
property `rep:externalId` is missing and it cannot be added without an
exception.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
