[
https://issues.apache.org/jira/browse/SLING-4461?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Marius Petria updated SLING-4461:
---------------------------------
Description:
ServiceUserMapperImpl has several levels of fallback for service user
resolution (fallback to bundle default, or to global default). While this
offers a lot of flexibility, it introduces non-determinism in a security
feature. If defaults are set, it can happen (especially at startup) that code
is executed using different serviceUsers, e.g. a component can execute using
the bundle default or
global default until its specific subService is available, and it can be
easily imagined how this can cause subtle errors.
was:
ServiceUserMapperImpl has several levels of fallback for
service user resolution (fallback to bundle default, or to global
default). While this offers a lot of flexibility, it introduces non-determinism
in a security feature. If defaults are set, it can
happen (especially at startup) that code is executed using different
serviceUsers, e.g. a component can execute using the bundle default or
global default until its specific subService is available, and it can be
easily imagined how this can cause subtle errors.
> Remove fallbacks for service users resolution
> ---------------------------------------------
>
> Key: SLING-4461
> URL: https://issues.apache.org/jira/browse/SLING-4461
> Project: Sling
> Issue Type: Improvement
> Components: Service User Mapper
> Reporter: Marius Petria
>
> ServiceUserMapperImpl has several levels of fallback for service user
> resolution (fallback to bundle default, or to global default). While this
> offers a lot of flexibility, it introduces non-determinism in a security
> feature. If defaults are set, it can happen (especially at startup) that code
> is executed using different serviceUsers, e.g. a component can execute using
> the bundle default or
> global default until its specific subService is available, and it can be
> easily imagined how this can cause subtle errors.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
