Mailing-List: contact users-help@jackrabbit.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@jackrabbit.apache.org
Received-SPF: pass (nike.apache.org: domain of ianboston@googlemail.com
 designates 209.85.219.206 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=googlemail.com; s=gamma;
        h=sender:message-id:from:to:in-reply-to:content-type
         :content-transfer-encoding:mime-version:subject:date:references
         :x-mailer;
        b=XeCy/iqxrx2X7eHjUNJp7d/umAT5aNyprzJdyvDUvLEkrKW3ZfyscJRIgpQGq1OZkW
         KGuKxJhSLOlozCk9tXe5ooOVGIVaAGPT54BQ6sU6MIu7fowcVvssXrWKNqXQZHOg50Mk
         0y7WzUKuldFbE4ZbQ40NXd/n6N2yQDVP2VeMA=
Sender: Ian Boston <ianboston@googlemail.com>
Message-Id: <A7351389-D13C-4CBE-A69B-25A741153686@tfd.co.uk>
From: Ian Boston <ieb@tfd.co.uk>
To: users@jackrabbit.apache.org
In-Reply-To: <1765B1C0-342C-47FD-A608-9799DB5B6E1B@TFD.CO.UK>
Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes
Content-Transfer-Encoding: 7bit
Mime-Version: 1.0 (Apple Message framework v935.3)
Subject: Re: Controlling who can modify groups.
Date: Tue, 4 Aug 2009 10:27:22 +0100
References: <1765B1C0-342C-47FD-A608-9799DB5B6E1B@TFD.CO.UK>


On 3 Aug 2009, at 18:44, Ian Boston wrote:

> Hi,
>
> Is there a standard way to control who can modify a group in the  
> Jackrabbit User Manager Impl.
>
> IIUC, there appears to be a Group (default GroupAdmin) that grant  
> the user write access to *all* groups, but no way of granting a user  
> administrative rights over a subset of all groups.
>
> Is this correct, or have a missed something ?
>
> Ian


On the basis that delegated administration of selected groups is not  
possible, would  the following patch be a "safe" thing to do in the  
UserAccessControlProvider. NB, this is *not* a request to patch  
Jackrabbit code, its just  question regarding the sanity of the  
approach.

in UserAccessControlProvider#CompiledPermissionsImpl.buildResult(...)

             } else if (groupsPath.equals(abs2Path)) {
                 /*
                 below group-tree:
                 - test if the user is group-administrator.
                 */
                 if (isGroupAdmin) {
                     allows = Permission.ALL;
                     if (calcPrivs) {
                         privs |= PrivilegeRegistry.WRITE;
                     }
                 } else {

// new code to allow group administration delegation

                   // check the group node to see if there are a list  
of admin groups.
                   Node node = (NodeImpl) getExistingNode(path);
                   if ( node.hasProperty(GROUPS_PROPERTY) ) {
                     Property groups =  
node.getProperty(GROUPS_PROPERTY);
                     for ( Value group : groups.getValues() ) {
                       String groupName = group.getString();
                       if ( containsGroup(userPrincipals, groupName)) {
                         allows = Permission.ALL;
                         if (calcPrivs) {
                             privs |= PrivilegeRegistry.WRITE;
                         }
                         break;
                       }
                     }
                   }
// end new code
                 }


             } // else outside of user/group tree -> read only.
             return new Result(allows, denies, privs,  
PrivilegeRegistry.NO_PRIVILEGE);
         }

Ian