Mailing-List: contact users-help@jackrabbit.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@jackrabbit.apache.org
Received-SPF: pass (athena.apache.org: domain of jukka.zitting@gmail.com
 designates 209.85.198.190 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=message-id:date:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
        b=oZS41noZRtLRS9Y9Fz8ASkAbrMgj7KQR6DlgY/WRYHFXrBpG73rc7IRNwm8pxwed5m7fVmNuorgZVZFlz8AMIVFFY3ifgo87gbo/+/3T/sW4YV4AundzQPTMjtR3MAsxMnNs6idzx4wa5E1po391zWKw3GkeWEhpd7Zm7oJc0yQ=
Message-ID: <510143ac0712131846k2acdfec4m7e15a4e3f68ea786@mail.gmail.com>
Date: Fri, 14 Dec 2007 04:46:29 +0200
From: "Jukka Zitting" <jukka.zitting@gmail.com>
To: users@jackrabbit.apache.org
Subject: Re: Authorization
In-Reply-To: <14322959.post@talk.nabble.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <14322959.post@talk.nabble.com>

Hi,

On Dec 13, 2007 9:22 PM, qcfireball <qcfireball@yahoo.com> wrote:
> It looks to me so far that Jackrabbit has no "native" Authorization provided
> with it.  I have looked at the source quite a bit the last couple days, and
> there does not seem to be anything of this sort.  Is this true?

Yes, currently we only ship a very rudimentary authorization mechanism
that basically just distinguishes between read-only access for a
specific "anonymous" account, and read-write access to everyone else.

> Are people implementing this themselves using the AccessManager interface?
> Are they using JeCARS to implement repository Authorization, or some other
> pre-built product?

Yes, there are a few threads (mostly on dev@) about implementing
custom AccessManagers. This is currently the recommended way of
implementing authorization policies in Jackrabbit.

Note that Day Software is currently contributing a rather
comprehensive ACL-based authorization component (see
https://issues.apache.org/jira/browse/JCR-1171), but this feature will
unfortunately not make it in the Jackrabbit 1.4 release. And if there
are other generic AccessManagers out there, I'd certainly be
interested in including also them in the Jackrabbit core.

BR,

Jukka Zitting