Return-Path: X-Original-To: apmail-jackrabbit-commits-archive@www.apache.org Delivered-To: apmail-jackrabbit-commits-archive@www.apache.org Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by minotaur.apache.org (Postfix) with SMTP id 55B6110780 for ; Tue, 12 Nov 2013 14:39:54 +0000 (UTC) Received: (qmail 69537 invoked by uid 500); 12 Nov 2013 14:39:46 -0000 Delivered-To: apmail-jackrabbit-commits-archive@jackrabbit.apache.org Received: (qmail 69454 invoked by uid 500); 12 Nov 2013 14:39:40 -0000 Mailing-List: contact commits-help@jackrabbit.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: dev@jackrabbit.apache.org Delivered-To: mailing list commits@jackrabbit.apache.org Received: (qmail 69381 invoked by uid 99); 12 Nov 2013 14:39:33 -0000 Received: from nike.apache.org (HELO nike.apache.org) (192.87.106.230) by apache.org (qpsmtpd/0.29) with ESMTP; Tue, 12 Nov 2013 14:39:33 +0000 X-ASF-Spam-Status: No, hits=-2000.0 required=5.0 tests=ALL_TRUSTED X-Spam-Check-By: apache.org Received: from [140.211.11.4] (HELO eris.apache.org) (140.211.11.4) by apache.org (qpsmtpd/0.29) with ESMTP; Tue, 12 Nov 2013 14:39:22 +0000 Received: from eris.apache.org (localhost [127.0.0.1]) by eris.apache.org (Postfix) with ESMTP id F363F2388831; Tue, 12 Nov 2013 14:38:58 +0000 (UTC) Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Subject: svn commit: r1541089 [1/2] - /jackrabbit/site/live/oak/docs/ Date: Tue, 12 Nov 2013 14:38:57 -0000 To: commits@jackrabbit.apache.org From: angela@apache.org X-Mailer: svnmailer-1.0.9 Message-Id: <20131112143858.F363F2388831@eris.apache.org> X-Virus-Checked: Checked by ClamAV on apache.org Author: angela Date: Tue Nov 12 14:38:57 2013 New Revision: 1541089 URL: http://svn.apache.org/r1541089 Log: OAK-936: Site checkin for project Oak Documentation-0.11-SNAPSHOT Added: jackrabbit/site/live/oak/docs/differences_accesscontrol.html (with props) jackrabbit/site/live/oak/docs/differences_authentication.html (with props) jackrabbit/site/live/oak/docs/differences_permission.html (with props) jackrabbit/site/live/oak/docs/differences_principal.html (with props) jackrabbit/site/live/oak/docs/differences_privileges.html (with props) jackrabbit/site/live/oak/docs/differences_user.html (with props) Modified: jackrabbit/site/live/oak/docs/blobstore.html jackrabbit/site/live/oak/docs/construct.html jackrabbit/site/live/oak/docs/dev_getting_started.html jackrabbit/site/live/oak/docs/differences.html jackrabbit/site/live/oak/docs/dos_and_donts.html jackrabbit/site/live/oak/docs/downloads.html jackrabbit/site/live/oak/docs/from_here.html jackrabbit/site/live/oak/docs/index.html jackrabbit/site/live/oak/docs/jsop-diff.html jackrabbit/site/live/oak/docs/known_issues.html jackrabbit/site/live/oak/docs/license.html jackrabbit/site/live/oak/docs/microkernel.html jackrabbit/site/live/oak/docs/mongomk.html jackrabbit/site/live/oak/docs/nodestate.html jackrabbit/site/live/oak/docs/overview.html jackrabbit/site/live/oak/docs/participating.html jackrabbit/site/live/oak/docs/query.html jackrabbit/site/live/oak/docs/segmentmk.html jackrabbit/site/live/oak/docs/use_getting_started.html jackrabbit/site/live/oak/docs/when_things_go_wrong.html Modified: jackrabbit/site/live/oak/docs/blobstore.html URL: http://svn.apache.org/viewvc/jackrabbit/site/live/oak/docs/blobstore.html?rev=1541089&r1=1541088&r2=1541089&view=diff ============================================================================== --- jackrabbit/site/live/oak/docs/blobstore.html (original) +++ jackrabbit/site/live/oak/docs/blobstore.html Tue Nov 12 14:38:57 2013 @@ -1,13 +1,13 @@ - + Jackrabbit Oak - @@ -154,7 +154,7 @@
    -
  • Last Published: 2013-11-05
    • +
  • Last Published: 2013-11-12
  • |
  • Version: 0.11-SNAPSHOT
    • Modified: jackrabbit/site/live/oak/docs/construct.html URL: http://svn.apache.org/viewvc/jackrabbit/site/live/oak/docs/construct.html?rev=1541089&r1=1541088&r2=1541089&view=diff ============================================================================== --- jackrabbit/site/live/oak/docs/construct.html (original) +++ jackrabbit/site/live/oak/docs/construct.html Tue Nov 12 14:38:57 2013 @@ -1,13 +1,13 @@ - + Jackrabbit Oak - @@ -154,7 +154,7 @@
      -
    • Last Published: 2013-11-05
      • +
    • Last Published: 2013-11-12
    • |
    • Version: 0.11-SNAPSHOT
      • Modified: jackrabbit/site/live/oak/docs/dev_getting_started.html URL: http://svn.apache.org/viewvc/jackrabbit/site/live/oak/docs/dev_getting_started.html?rev=1541089&r1=1541088&r2=1541089&view=diff ============================================================================== --- jackrabbit/site/live/oak/docs/dev_getting_started.html (original) +++ jackrabbit/site/live/oak/docs/dev_getting_started.html Tue Nov 12 14:38:57 2013 @@ -1,13 +1,13 @@ - + Jackrabbit Oak - @@ -154,7 +154,7 @@
        -
      • Last Published: 2013-11-05
        • +
      • Last Published: 2013-11-12
      • |
      • Version: 0.11-SNAPSHOT
        • Modified: jackrabbit/site/live/oak/docs/differences.html URL: http://svn.apache.org/viewvc/jackrabbit/site/live/oak/docs/differences.html?rev=1541089&r1=1541088&r2=1541089&view=diff ============================================================================== --- jackrabbit/site/live/oak/docs/differences.html (original) +++ jackrabbit/site/live/oak/docs/differences.html Tue Nov 12 14:38:57 2013 @@ -1,13 +1,13 @@ - + Jackrabbit Oak - @@ -154,7 +154,7 @@
          -
        • Last Published: 2013-11-05
          • +
        • Last Published: 2013-11-12
        • |
        • Version: 0.11-SNAPSHOT
          • @@ -418,41 +418,22 @@

          Same name siblings (SNS) are deprecated in Oak. We figured that the actual benefit supporting same name siblings as mandated by JCR is dwarfed by the additional implementation complexity. Instead there are ideas to implement a feature for automatic disambiguation of node names.

          In the meanwhile we have basic support for same name siblings but that might not cover all cases.

          -

          Authentication

          -

          Please refer to OAK-793 for a general overview of changes with respect to Jackrabbit 2.

          -
          -

          Access Control Management

          -

          Refer to OAK-792 for a general overview of changes with respect to Jackrabbit 2.

          -

          The following modification are most likely to have an effect on existing applications:

          +

          Security

            -
          • AccessControlManager#hasPrivilege() and AccessControlManager#getPrivileges() will throw a PathNotFoundException if the node for the specified path is not accessible. The Jackrabbit 2 implementation is wrong and we fixed that in OAK (OAK-886). If the new behaviour turns out to be a problem with existing applications we might consider adding backward compatible behaviour.
            • -
          -
          -

          Permissions

          -

          Refer to OAK-942 for a general overview of changes with respect to Jackrabbit 2.

          - -
            +
          • AccessControl Management
            • -
          • -

            As of Oak Node#remove() only requires sufficient permissions to remove the target node. In contrast to jackrabbit the validation will not traverse the tree and verify remove permission on all child nodes/properties. There exists a configuration flag that aims to produce best effort backwards compatibility but this flag is currently not enabled by default. Please let us know if you suspect this causes wrong behavior in your application.

            • +
          • Authentication
            • -
          • -

            By default user management operations require the specific user mgt related permission that has been introduced with OAK-1.0. This behavior can be turned off by setting the corresponding configuration flag.

            • +
          • Permission Evaluation
            • -
          • -

            As of OAK reading and writing items in the version store does not follow the regular permission evaluation but depends on access rights present on the corresponding versionable node OAK-444.

            • +
          • Principal Management
            • + +
          • Privilege Management
            • + +
          • User Management
          -
          -

          Privilege Management

          -

          Refer to OAK-910 for a general overview of changes with respect to Jackrabbit 2.

          -
          -

          User Management

          -

          Refer to OAK-791 for a general overview of changes with respect to Jackrabbit 2.

          -
          -

          Principal Management

          -

          Refer to OAK-909 for a general overview of changes with respect to Jackrabbit 2.

          Added: jackrabbit/site/live/oak/docs/differences_accesscontrol.html URL: http://svn.apache.org/viewvc/jackrabbit/site/live/oak/docs/differences_accesscontrol.html?rev=1541089&view=auto ============================================================================== --- jackrabbit/site/live/oak/docs/differences_accesscontrol.html (added) +++ jackrabbit/site/live/oak/docs/differences_accesscontrol.html Tue Nov 12 14:38:57 2013 @@ -0,0 +1,512 @@ + + + + + + + + + Jackrabbit Oak - + + + + + + + + + + + + + + + + + + Fork me on GitHub + + + + + + +
          +
          +
          + + + + + + + + + + + +
          + +
          +
          + + +
          + + + + + +
          +
          +
          + + + + + + +
          + +
          + + + + +
          + +
          +
          +
          + + Built by Maven + +
          +
          +
          + + +
          + +
          +
          +

          AccessControl Management : Differences wrt Jackrabbit 2.x

          +
          +

          1. Characteristics of the Default Implementation

          +
          +
          General
          +

          In general the authorization related code in OAK clearly separates between access control management (such as defined by the JCR and Jackrabbit API) and the internal permission evaluation (see also Permission Evaluation).

          +

          The default implementation of the access control management corresponds to the resource-based implementation present with Jackrabbit 2.x. The former principal-base access control management is no longer available but it’s functionality has been incorporated both in the default ac management implementation and the permission evaluation.

          +
          +
          JCR API
          +
          +
          AccessControlManager#hasPrivilege and #getPrivileges
          +

          As of OAK those methods throw PathNotFoundException if the corresponding node is not accessible by the editing session. This is in accordance with the behavior mandated by JSR 283 and a bug in Jackrabbit 2.x.

          +
          +
          AccessControlManager#getEffectivePolicies
          +

          In contrast to Jackrabbit 2.x the editing session is used to retrieve the effective policies and the policies returned by these methods are guarantueed to only return information that is otherwise accessible by the session. The corresponding methods in Jackrabbit 2.x use to throw an exception in this situation.

          +
          +
          AccessControlPolicy
          +

          OAK introduces a new type of policy that enforces regular read-access for everyone on the trees that hold this new ReadPolicy [0]. The main usage of this new policy is to ensure backwards compatible behavior of repository level information (node types, namespace, privileges) that are now kept within the content repository. In Jackrabbit 2.x this information was stored in the file system without the ability to apply or enforce regular access control such as present with items in the repository.

          +

          Currently these special read policies are defined as part of the overall security configuration and cannot be managed/edited using regular access control management API (see (OAK-951)).

          +
          +
          AccessControlEntry
          +

          Validation: as of OAK the implementation of the AccessControlEntry interface is no longer in charge of validating the specified privileges. While some validation is still performed in the corresponding AccessControlList methods, the complete validation is delegated to the commit phase and executed by a specific Validator implementation.

          +

          Restrictions: as of OAK the optional restrictions present with a given JackrabbitAccessControlEntry can be multivalued (see below).

          +
          +
          Jackrabbit API
          +
          +
          Principal-based Access Control
          +

          The principal-based access control management as present in Jackrabbit-core is no longer present with OAK. The main benefit of the principal-based approach has been incorporated with the changes in the default permission evaluation). In addition the default access control manager implementation supports all methods defined by JackrabbitAccessControlManager; i.e. editing access control information by principal is possible as long as the editing session has sufficient permission on the target node(s). Similarly, the per principal policies exposed to a given session will always respect that access rights of that session.

          +
          +
          Restrictions
          +

          The implementation of the additional restrictions associated with an ACE has been modified/extended as follows:

          + +
            + +
          • Separate restriction management API (see below) on the OAK level that allows to ease plugging custom restrictions.
            • + +
          • Changed node type definition for storing restrictions in the default implementation. + +
              + +
            • as of OAK restrictions are collected underneath a separate child node “rep:restrictions”
              • + +
            • restrictions can be multi-valued (see JCR-3637, JCR-3641)
              • + +
            • backwards compatible behavior for restrictions stored underneath the ACE node directly
              • +
            • + +
          • New restrictions: + +
              + +
            • “rep:ntNames”, which allows to limit the affected ACE to nodes of the specified node type(s)
              • + +
            • “rep:prefixes”, which allows to limit the effect to item names that have a specific namespace prefix.
              • +
            • +
          +
          +

          2. Node Types

          +

          As mentioned above the node type definitions have been extended to match the new functionality related to restrictions. The node type definition for access control entries:

          + +
          +
          [rep:ACE]
+  - rep:principalName (STRING) protected mandatory
+  - rep:privileges (NAME) protected mandatory multiple
+  - rep:nodePath (PATH) protected /* deprecated in favor of restrictions */
+  - rep:glob (STRING) protected   /* deprecated in favor of restrictions */
+  - * (UNDEFINED) protected       /* deprecated in favor of restrictions */
+  + rep:restrictions (rep:Restrictions) = rep:Restrictions protected
+
          +

          The new node type definition for restrictions:

          + +
          +
          /**
+ * @since oak 1.0
+ */
+[rep:Restrictions]
+  - * (UNDEFINED) protected
+  - * (UNDEFINED) protected multiple
+
          +
          +

          3. API Extensions and Public Classes

          +

          org.apache.jackrabbit.oak.spi.security.authorization.accesscontrol [1]

          + +
            + +
          • AbstractAccessControlList
            • + +
          • ImmutableACL
            • + +
          • ACE
            • +
          +

          org.apache.jackrabbit.oak.spi.security.authorization.restriction [2]

          + +
            + +
          • RestrictionProvider:
            • + +
          • RestrictionDefinition
            • + +
          • RestrictionPattern
            • + +
          • Restriction
            • +
          +
          +

          4. Configuration

          +

          The following access control related configuration options are present with the AuthorizationConfiguration as of OAK 1.0 [3]

          + +
            + +
          • getAccessControlManager
            • + +
          • getRestrictionProvider
            • +
          +

          Differences to Jackrabbit 2.x:

          + +
            + +
          • The “omit-default-permission” configuration option present with the Jackrabbit’s AccessControlProvider implementations is no longer supported with Oak.
            • + +
          • As of OAK no extra access control content is installed by default which renders that flag superfluous.
            • +
          +
          +

          5. Important Note

          +

          The following modification is most likely to have an effect on existing applications:

          + +
            + +
          • AccessControlManager#hasPrivilege() and AccessControlManager#getPrivileges() will throw a PathNotFoundException if the node for the specified path is not accessible. The Jackrabbit 2 implementation is wrong and we fixed that in OAK (OAK-886). If the new behaviour turns out to be a problem with existing applications we might consider adding backward compatible behaviour.
            • +
          +
          +

          6. References

          +

          [0] https://issues.apache.org/jira/browse/OAK-951

          +

          [1] http://svn.apache.org/repos/asf/jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/spi/security/authorization/restriction/

          +

          [2] http://svn.apache.org/repos/asf/jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/spi/security/authorization/accesscontrol/

          +

          [3] http://svn.apache.org/repos/asf/jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/spi/security/authorization/AuthorizationConfiguration.java

          +
          +
          +
          + +
          + + + + \ No newline at end of file Propchange: jackrabbit/site/live/oak/docs/differences_accesscontrol.html ------------------------------------------------------------------------------ svn:eol-style = native Added: jackrabbit/site/live/oak/docs/differences_authentication.html URL: http://svn.apache.org/viewvc/jackrabbit/site/live/oak/docs/differences_authentication.html?rev=1541089&view=auto ============================================================================== --- jackrabbit/site/live/oak/docs/differences_authentication.html (added) +++ jackrabbit/site/live/oak/docs/differences_authentication.html Tue Nov 12 14:38:57 2013 @@ -0,0 +1,556 @@ + + + + + + + + + Jackrabbit Oak - + + + + + + + + + + + + + + + + + + Fork me on GitHub + + + + + + +
          +
          +
          + + + + + + + + + + + +
          + +
          +
          + + +
          + + + + + +
          +
          +
          + + + + + + +
          + +
          + + + + +
          + +
          +
          +
          + + Built by Maven + +
          +
          +
          + + +
          + +
          +
          +

          Authentication : Differences wrt Jackrabbit 2.x

          +
          +

          1. Characteristics of the Default Implementation

          +
          +
          Null Login
          +

          As of Oak 1.0 Repository#login() and Repository#login(null, wspName) is no longer treated as guest login. This behavior of Jackrabbit-core is violating the specification, which defines that null-login should be used for those cases where the authentication process is handled outside of the repository (-> see pre-authentication below).

          +

          In order to get a full backwards compatible behavior OAK provides a specific GuestLoginModule [0] that can be added to the JAAS (or corresponding OSGI) configuration.

          +

          Example JAAS Configuration:

          + +
          +
          jackrabbit.oak {
+   org.apache.jackrabbit.oak.spi.security.authentication.GuestLoginModule  optional;
+   org.apache.jackrabbit.oak.security.authentication.user.LoginModuleImpl required;
+};
+
          +
          +
          Guest Login
          +

          With respect to guest login (aka anonymous login) the OAK content repository out of the box contains the following modifications:

          + +
            + +
          • null login != guest login
            • + +
          • no anonymous login with uid/pw
            • +
          +

          As explained in 1) the null login will not longer fall back to a guest login unless explicitly configured (-> GuestLoginModule). The proper way to obtain an guest session as of OAK is as specified by JSR 283:

          + +
          +
          String wspName = null;
+Session anonymous = repository.login(new GuestCredentials(), wspName);
+
          +

          Similarly, the special treatment that jackrabbit core applied for the guest (anonymous) user has been omitted altogether in OAK. In the default setup the anonymous user will created without any password. Therefore explicitly uid/pw login using the anonymous userId will no longer work. This behavior is now consistent with the default login of any other user which doesn’t have a password set.

          +
          +
          Pre-Authentication in the LoginContextProvider
          +

          Like in Jackrabbit-core the repository internal authentication verification can be skipped by calling Repository#login() or Repository#login(null, wspName). In this case the repository implementation expects the verification to be performed prior to the login call.

          +

          This behavior is provided by the default implementation of the LoginContextProvider [1] which expects a Subject to be available with the current java.security.AccessControlContext. However, in contrast to Jackrabbit-core the current implementation does not try to extend the pre-authenticated subject but skips the internal verification step altogether.

          +

          Since the LoginContextProvider is a configurable with the authentication setup OAK users also have the following options by providing a custom LoginContextProvider:

          + +
            + +
          • Disable pre-authentication by not trying to retrieve a pre-authenticated Subject.
            • + +
          • Add support for extending the pre-authenticated subject by always passing writable subjects to the JaasLoginContext
            • + +
          • Dropping JAAS altogether by providing a custom implementation of the org.apache.jackrabbit.oak.spi.security.authentication.LoginContext [2] interface.
            • +
          +

          Example how to use the pre-auth:

          + +
          +
          String userId = "test";
+/**
+ Retrive valid principals e.g. by calling jackrabbit API
+ - PrincipalManager#getPrincipal and/or #getGroupMembership
+ or from Oak SPI
+ - PrincipalProvider#getPrincipals(String userId)
+ */
+Set<? extends Principal> principals = getPrincipals(userId);
+AuthInfo authInfo = new AuthInfoImpl(userId, Collections.<String, Object>emptyMap(), principals);
+Subject subject = new Subject(true, principals, Collections.singleton(authInfo), Collections.<Object>emptySet());
+Session session;
+try {
+    session = Subject.doAsPrivileged(subject, new PrivilegedExceptionAction<Session>() {
+        @Override
+        public Session run() throws Exception {
+            return login(null, null);
+        }
+    }, null);
+} catch (PrivilegedActionException e) {
+    throw new RepositoryException("failed to retrieve session.", e);
+}
+
          +
          +

          2. Impersonation

          +
          +
          Self-Impersonation (aka Cloning a Session)
          +

          As of OAK 1.0 the latest changes made to JSR 333 with respect to Session#impersonate have been adopted [3]: Any attempt to impersonate the same session (self-impersonation) will succeed as long as the user is still valid.

          +
          +
          Impersonation Credentials
          +

          The OAK implementation of Session#impersonate no longer uses SimpleCredentials to transport the original Subject but rather performs the login with dedicated ImpersonationCredentials [4].

          +

          With this change the impersonation feature no longer relies on SimpleCredentials being passed to Session#impersonate call. Instead the specified credentials are passed to a new instance of ImpersonationCredentials delegating the evaluation and validation of the specified Credentials to the configured login module(s).

          +

          This modification will not affect applications that used JCR API to impersonate a given session. However the following example which ‘manually’ builds impersonation credentials the way jackrabbit core was handling it will no longer work to impersonate an existing session:

          + +
          +
           SessionImpl sImpl = (SessionImpl) mySession;
+ SimpleCredentials jrImpCreds = new SimpleCredentials("someUserId, new char[0]);
+ creds.setAttribute(SecurityConstants.IMPERSONATOR_ATTRIBUTE, sImpl.getSubject());
+ Session impersonated = sImpl.getRepository().login(jrImpCreds, sImpl.getWorkspace().getName());
+
          +
          +

          3. Token based Authentication

          +

          The token based authentication has been completely refactor in OAK.

          + +
            + +
          • Dedicated API for managing login tokens [5]
            • + +
          • Pluggable configuration of the new token management API
            • + +
          • Complete separation of token based authentication from regular uid/pw authentication into a separate LoginModule [6]
            • +
          +

          The default implementation differs from jackrabbit as follows - token node is referenceable with a dedicated node type (rep:Token) - expiration and key properties are mandatory and protected - expiration time is obtained from PARAM_TOKEN_EXPIRATION specified in the login attributes and falls back to the same configuration parameter.

          +

          The definition of the new built-in node type “rep:Token”: [rep:Token] > mix:referenceable - rep:token.key (STRING) protected mandatory - rep:token.exp (DATE) protected mandatory - * (UNDEFINED) protected - * (UNDEFINED) multiple protected

          +

          Please note the following difference with respect to Jackrabbit core: - the TokenLoginModule is responsible for creating new login tokens. Other login modules should not attempt to do so. - token characteristics such as expiration time only need to be configured with the TokenLoginModule - Other LoginModule implementations consequently no longer need to have the same config options set.

          +
          +

          4. External Authentication

          +

          While the default setup in OAK is solely relying on repository functionality to ensure proper authentication it quite common to authenticate against different systems (e.g. LDAP). For those setups that wish to combine initial authentication against a third party system with repository functionality, OAK provides some basic implementation and extension points [7] and ship an example setup for LDAP authentication.

          +

          This is aimed to become the replacement for com.day.crx.security.ldap.LDAPLoginModule [8], which relies on jackrabbit internals and will no longer work with OAK.

          +
          +

          5. API Extensions

          +

          The OAK project introduces the following authenticated related service provider interfaces:

          +

          org.apache.jackrabbit.oak.spi.security.authentication:

          + +
            + +
          • LoginContextProvider: Configurable provider of the LoginContext (see below)
            • + +
          • LoginContext: Interface version of the JAAS LoginContext aimed to ease integration with non-JAAS components
            • + +
          • Authentication: Aimed to validate credentials during the first phase of the (JAAS) login process.
            • +
          +

          org.apache.jackrabbit.oak.spi.security.authentication.token:

          + +
            + +
          • TokenProvider: Interface to manage login tokens.
            • + +
          • TokenInfo: Information related to a login token and token validity.
            • +
          +

          org.apache.jackrabbit.oak.spi.security.authentication.external:

          + +
            + +
          • interfaces to ease custom implementation of the external authentication with optional user/group synchronization to the repository (see [7]).
            • +
          +
          +

          6. Configuration

          +
          +
          AuthenticationConfiguration [9]:
          + +
            + +
          • getLoginContextProvider -> configuration of the login context
            • + +
          • getTokenProvider -> configuration of the token management implementation
            • +
          +
          +
          Utilities
          +

          There also exists a utility class that allows to obtain different javax.security.auth.login.Configuration for the most common setup [10]:

          + +
            + +
          • +

            ConfigurationUtil#getDefaultConfiguration: default OAK configuration supporting uid/pw login configures LoginModuleImpl only

            • + +
          • +

            ConfigurationUtil#getJackrabbit2Configuration: backwards compatible configuration that provides the functionality covered by jackrabbit-core DefaultLoginModule, namely:

            + +
              + +
            • GuestLoginModule: null login falls back to anonymous
              • + +
            • TokenLoginModule: covers token base authentication
              • + +
            • LoginModuleImpl: covering regular uid/pw login
              • +
            • +
          +
          +

          7. References

          +

          [0] http://svn.apache.org/repos/asf/jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/GuestLoginModule.java

          +

          [1] http://svn.apache.org/repos/asf/jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/LoginContextProvider.java

          +

          [2] http://svn.apache.org/repos/asf/jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/LoginContext.java

          +

          [3] https://java.net/jira/browse/JSR_333-27

          +

          [4] http://svn.apache.org/repos/asf/jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/ImpersonationCredentials.java

          +

          [5] http://svn.apache.org/repos/asf/jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/token/

          +

          [6] http://svn.apache.org/repos/asf/jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authentication/token/TokenLoginModule.java

          +

          [7] http://svn.apache.org/repos/asf/jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/external/

          +

          [8] http://dev.day.com/docs/en/crx/current/administering/ldap_authentication.html

          +

          [9] http://svn.apache.org/repos/asf/jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/AuthenticationConfiguration.java

          +

          [10] http://svn.apache.org/repos/asf/jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/ConfigurationUtil.java

          +
          +
          +
          + +
          + + + + \ No newline at end of file Propchange: jackrabbit/site/live/oak/docs/differences_authentication.html ------------------------------------------------------------------------------ svn:eol-style = native Added: jackrabbit/site/live/oak/docs/differences_permission.html URL: http://svn.apache.org/viewvc/jackrabbit/site/live/oak/docs/differences_permission.html?rev=1541089&view=auto ============================================================================== --- jackrabbit/site/live/oak/docs/differences_permission.html (added) +++ jackrabbit/site/live/oak/docs/differences_permission.html Tue Nov 12 14:38:57 2013 @@ -0,0 +1,392 @@ + + + + + + + + + Jackrabbit Oak - + + + + + + + + + + + + + + + + + + Fork me on GitHub + + + + + + +
          +
          +
          + + + + + + + + + + + +
          + +
          +
          + + +
          + + + + + +
          +
          +
          + + + + + + +
          + +
          + + + + +
          + +
          +
          +
          + + Built by Maven + +
          +
          +
          + + +
          + +
          +
          +

          Permission Evaluation : Differences wrt Jackrabbit 2.x

          +

          NOTE: Work in Progress

          +

          Refer to OAK-942 for a general overview of changes with respect to Jackrabbit 2.

          + +
            + +
          • +

            As of Oak Node#remove() only requires sufficient permissions to remove the target node. In contrast to jackrabbit the validation will not traverse the tree and verify remove permission on all child nodes/properties. There exists a configuration flag that aims to produce best effort backwards compatibility but this flag is currently not enabled by default. Please let us know if you suspect this causes wrong behavior in your application.

            • + +
          • +

            By default user management operations require the specific user mgt related permission that has been introduced with OAK-1.0. This behavior can be turned off by setting the corresponding configuration flag.

            • + +
          • +

            As of OAK reading and writing items in the version store does not follow the regular permission evaluation but depends on access rights present on the corresponding versionable node OAK-444.

            • +
          +
          +
          +
          + +
          + + + + \ No newline at end of file Propchange: jackrabbit/site/live/oak/docs/differences_permission.html ------------------------------------------------------------------------------ svn:eol-style = native