[
https://issues.apache.org/jira/browse/OAK-791?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13713475#comment-13713475
]
angela edited comment on OAK-791 at 7/19/13 12:17 PM:
------------------------------------------------------
1) Characteristics of the Default Implementation
----------------------------------------------------------------------------------------------------------------------------
The default user management implementation present with OAK always stores
user/group information in the workspace associated with the editing Session
(see jr2 UserPerWorkspaceUserManager). The implementation of a user mgt variant
corresponding to Jackrabbit's default
UserManagerImpl is blocked by missing workspace handling (see OAK-118).
The current user manager has the following characteristics that differ from the
corresponding Jackrabbit implementation:
a) General
- Changes made to the user management API are always transient and require
Session#save() to be persisted.
- In case of a failure Session#refresh is no longer called in order to prevent
reverting other changes unrelated to the user mgt operation. Consequently it's
the responsibility of the API consumer to specifically revert pending or
invalid transient modifications.
- The implementation is no longer built on top of the JCR API but instead
directly acts on Tree and PropertyState defined by the OAK API. This move
allows to make use of the user management API within the OAK layer (aka SPI).
b) User/Group creation
- The rep:password property is no longer defined to be mandatory. Therefore a
new user might be created without specifying a password. Note however, that
User#changePassword does not allow to remove the password property.
- UserManager#createGroup(Principal) will no longer generate a groupID in case
the principal name collides with an existing user or group ID. This has been
considered redundant as the Jackrabbit API in the mean time added
UserManager#createGroup(String groupID).
- Since OAK is designed to scale with flat hierarchies the former configuration
options 'autoExpandTree' and 'autoExpandSize' are no longer supported.
c) Handling of the Authorizable ID
- As of OAK the node type definition of rep:Authorizable defines a new property
rep:authorizableId which is intended to store the ID of a user or group.
- The default implementation comes with a dedicated property index for
rep:authorizableId which asserts the uniqueness of that ID.
- Authorizable#getID returns the string value contained in rep:authorizableID
and for backwards compatibility falls back on the node name in case the ID
property is missing.
- The name of the authorizable node is generated based on a configurable
implementation of the 'AuthorizableNodeName' interface (see configuration
section below). By default it uses the ID as name hint and includes a
conversion to a valid JCR node name.
d) Equals and HashCode for Authorizables
The implementation of Object#equals() and Object#hashCode() for user and groups
slightly differs from Jackrabbit 2.x. It no longer relies on the sameness of
the underlaying JCR node but only compares IDs and the user manager instance.
e) Autosave behavior
Due to the nature of the UserManager (see above) we decided to drop the
auto-save behavior in the default implementation present with OAK. Consequently,
- UserManager#autoSave(boolean) throws UnsupportedRepositoryOperationException
- UserManager#isAutoSave() always returns false
2) Builtin Users
----------------------------------------------------------------------------------------------------------------------------
The setup of builtin user and group accounts is triggered by the configured
WorkspaceInitializer associated with the user management configuration (see
Configuration section below).
The default user mgt implementation in OAK comes with an initializer that
creates the following builtin user accounts (as in JR2):
a) Administrator user
The admin user is always being created. The ID of this user is retrieved from
the user configuration parameter PARAM_ADMIN_ID, which defaults to "admin".
As of OAK 1.0 however the administrator user might be created without initial
password forcing the application to set the password upon start (see
PARAM_OMIT_ADMIN_PW configuration parameter).
b) Anonymous user
In contrast to Jackrabbit 2.x the anonymous (or guest) user is optional.
Creation will be skipped if the value of the PARAM_ANONYMOUS_ID configuration
parameter is null or empty.
Note, that the anonymous user will always be created without specifying a
password in order to prevent login with SimpleCredentials.
The proper way to obtain a guest session is [see also OAK-793]:
{code}
Repository#login(new GuestCredentials(), wspName);
{code}
3) Authorizable Actions
----------------------------------------------------------------------------------------------------------------------------
4) API Extensions
----------------------------------------------------------------------------------------------------------------------------
5) Configuration
----------------------------------------------------------------------------------------------------------------------------
* User Configuration []
** getUserManager: Obtain a new user manager instance
** getAuthorizableActionProvider: Obtain a new instance of the
AuthorizableActionProvider (see 3)
* Configuration Parameters supported by the default implementation
** PARAM_ADMIN_ID: String, default: "admin"
** PARAM_OMIT_ADMIN_PW: boolean, default: false
** PARAM_ANONYMOUS_ID: String, default: "anonymous", nullable
** PARAM_USER_PATH: String, default:
"/rep:security/rep:authorizables/rep:users"
** PARAM_GROUP_PATH: String, default:
"/rep:security/rep:authorizables/rep:groups",
** PARAM_DEFAULT_DEPTH: int, default: 2
** PARAM_GROUP_MEMBERSHIP_SPLIT_SIZE: int, default: -
** PARAM_PASSWORD_HASH_ALGORITHM: String, default: "SHA-256"
** PARAM_PASSWORD_HASH_ITERATIONS: int, default: 1000
** PARAM_PASSWORD_SALT_SIZE: int, default: 8
** PARAM_AUTHORIZABLE_NODE_NAME: AuthorizableNodeName, default:
AuthorizableNodeName#DEFAULT
The following configuration parameters present with the default implementation
in Jackrabbit 2.x are no longer supported and will be ignored:
* "compatibleJR16"
* "autoExpandTree"
* "autoExpandSize"
6) References
----------------------------------------------------------------------------------------------------------------------------
was (Author: anchela):
1) Characteristics of the Default Implementation
----------------------------------------------------------------------------------------------------------------------------
The default user management implementation present with OAK always stores
user/group information in the workspace associated with the editing Session
(see jr2 UserPerWorkspaceUserManager). The implementation of a user mgt variant
corresponding to Jackrabbit's default
UserManagerImpl is blocked by missing workspace handling (see OAK-118).
The current user manager has the following characteristics that differ from the
corresponding Jackrabbit implementation:
a) General
- Changes made to the user management API are always transient and require
Session#save() to be persisted.
- In case of a failure Session#refresh is no longer called in order to prevent
reverting other changes unrelated to the user mgt operation. Consequently it's
the responsibility of the API consumer to specifically revert pending or
invalid transient modifications.
- The implementation is no longer built on top of the JCR API but instead
directly acts on Tree and PropertyState defined by the OAK API. This move
allows to make use of the user management API within the OAK layer (aka SPI).
b) User/Group creation
- The rep:password property is no longer defined to be mandatory. Therefore a
new user might be created without specifying a password. Note however, that
User#changePassword does not allow to remove the password property.
- UserManager#createGroup(Principal) will no longer generate a groupID in case
the principal name collides with an existing user or group ID. This has been
considered redundant as the Jackrabbit API in the mean time added
UserManager#createGroup(String groupID).
- Since OAK is designed to scale with flat hierarchies the former configuration
options 'autoExpandTree' and 'autoExpandSize' are no longer supported.
c) Handling of the Authorizable ID
- As of OAK the node type definition of rep:Authorizable defines a new property
rep:authorizableId which is intended to store the ID of a user or group.
- The default implementation comes with a dedicated property index for
rep:authorizableId which asserts the uniqueness of that ID.
- Authorizable#getID returns the string value contained in rep:authorizableID
and for backwards compatibility falls back on the node name in case the ID
property is missing.
- The name of the authorizable node is generated based on a configurable
implementation of the 'AuthorizableNodeName' interface (see configuration
section below). By default it uses the ID as name hint and includes a
conversion to a valid JCR node name.
d) Equals and HashCode for Authorizables
The implementation of Object#equals() and Object#hashCode() for user and groups
slightly differs from Jackrabbit 2.x. It no longer relies on the sameness of
the underlaying JCR node but only compares IDs and the user manager instance.
e) Autosave behavior
Due to the nature of the UserManager (see above) we decided to drop the
auto-save behavior in the default implementation present with OAK. Consequently,
- UserManager#autoSave(boolean) throws UnsupportedRepositoryOperationException
- UserManager#isAutoSave() always returns false
2) Builtin Users
----------------------------------------------------------------------------------------------------------------------------
The setup of builtin user and group accounts is triggered by the configured
WorkspaceInitializer associated with the user management configuration (see
Configuration section below).
The default user mgt implementation in OAK comes with an initializer that
creates the following builtin user accounts (as in JR2):
a) Administrator user
The admin user is always being created. The ID of this user is retrieved from
the user configuration parameter PARAM_ADMIN_ID, which defaults to "admin".
As of OAK 1.0 however the administrator user might be created without initial
password forcing the application to set the password upon start (see
PARAM_OMIT_ADMIN_PW configuration parameter).
b) Anonymous user
In contrast to Jackrabbit 2.x the anonymous (or guest) user is optional.
Creation will be skipped if the value of the PARAM_ANONYMOUS_ID configuration
parameter is null or empty.
Note, that the anonymous user will always be created without specifying a
password in order to prevent login with SimpleCredentials.
The proper way to obtain a guest session is [see also OAK-793]:
{code}
Repository#login(new GuestCredentials(), wspName);
{code}
3) Authorizable Actions
----------------------------------------------------------------------------------------------------------------------------
4) API Extensions
----------------------------------------------------------------------------------------------------------------------------
5) Configuration
----------------------------------------------------------------------------------------------------------------------------
# User Configuration []
## getUserManager: Obtain a new user manager instance
## getAuthorizableActionProvider: Obtain a new instance of the
AuthorizableActionProvider (see 3)
# Configuration Parameters supported by the default implementation
## PARAM_ADMIN_ID: String, default: "admin"
## PARAM_OMIT_ADMIN_PW: boolean, default: false
## PARAM_ANONYMOUS_ID: String, default: "anonymous", nullable
## PARAM_USER_PATH: String, default:
"/rep:security/rep:authorizables/rep:users"
## PARAM_GROUP_PATH: String, default:
"/rep:security/rep:authorizables/rep:groups",
## PARAM_DEFAULT_DEPTH: int, default: 2
## PARAM_GROUP_MEMBERSHIP_SPLIT_SIZE: int, default: -
## PARAM_PASSWORD_HASH_ALGORITHM: String, default: "SHA-256"
## PARAM_PASSWORD_HASH_ITERATIONS: int, default: 1000
## PARAM_PASSWORD_SALT_SIZE: int, default: 8
## PARAM_AUTHORIZABLE_NODE_NAME: AuthorizableNodeName, default:
AuthorizableNodeName#DEFAULT
The following configuration parameters present with the default implementation
in Jackrabbit 2.x are no longer supported and will be ignored:
# "compatibleJR16"
# "autoExpandTree"
# "autoExpandSize"
6) References
----------------------------------------------------------------------------------------------------------------------------
> UserManagement: Document changes wrt Jackrabbit 2
> -------------------------------------------------
>
> Key: OAK-791
> URL: https://issues.apache.org/jira/browse/OAK-791
> Project: Jackrabbit Oak
> Issue Type: Sub-task
> Components: jcr
> Reporter: angela
> Assignee: angela
>
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
