Mailing-List: contact users-help@jackrabbit.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@jackrabbit.apache.org
Received-SPF: pass (athena.apache.org: domain of fcarriedos@gmail.com
 designates 209.85.216.177 as permitted sender)
MIME-Version: 1.0
Reply-To: fcarriedos@gmail.com
From: Francisco Carriedo Scher <fcarriedos@gmail.com>
Date: Tue, 26 Jul 2011 12:15:15 +0200
Message-ID: 
 <CAFWtOcOZ6F=-4dHj_FkFu29Ji28VE5vfJpHP8+wjCxUQRA35rQ@mail.gmail.com>
Subject: AccessControlException
To: users@jackrabbit.apache.org
Content-Type: multipart/alternative; boundary=0016e65bbc466b6df404a8f63649

--0016e65bbc466b6df404a8f63649
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

Hi there,

i am trying to assign an Acl to a folder node with the code below. Some
questions regarding access control arised and i would like to ask for links
where accurate info about my issues could be found or a brief explanation i=
n
order to explore the appropiate path (could be i went the wrong way while
checking the wiki and the Javadoc of the API...).

The code:

*********** BEGIN OF MY CODE *******************

    private void assignInitialPermissions(User u, Principal principal,
String usersPath, Session session) throws
UnsupportedRepositoryOperationException, RepositoryException {


        ValueFactory vf =3D session.getValueFactory();
        AccessControlManager acm =3D session.getAccessControlManager();
        List<AccessControlEntryImpl> aces =3D new
ArrayList<AccessControlEntryImpl>();
        Privilege privileges[] =3D acm.getSupportedPrivileges(usersPath);//=
new
Privilege[2];// =3D { Privilege.JCR_ADD_CHILD_NODES,
Privilege.JCR_REMOVE_CHILD_NODES};
        Map<String, Integer> restrictions =3D new HashMap<String, Integer>(=
);

        privileges =3D new Privilege[] { privileges[3] , privileges[8] };

        // Adding restrictions: dummy restrictions since i found no clear
explanation, but just trying right now
        restrictions.put("rep:nodePath", new Integer(1234));
        restrictions.put("rep:glob", new Integer(1234));

        System.out.println("Privilegios a a=F1adir: " +
privileges[0].getName() + " " + privileges[1].getName());

        // IMPORTANT, adding at the very first place!!!
        // since it takes the first matching entry
        aces.add(0,new AccessControlEntryImpl(principal, privileges) {

            @Override
            protected ValueFactory getValueFactory() {
                // TODO Auto-generated method stub
                return null;
            }

            @Override
            protected NameResolver getResolver() {
                // TODO Auto-generated method stub
                return null;
            }
        });

        // Finally build and acl and assign it to the corresponding path
        UnmodifiableAccessControlList acl =3D new
UnmodifiableAccessControlList(aces, usersPath, restrictions);
        acm.setPolicy(acl.getPath(), acl);

    }


************** END OF MY CODE ***********************


********************* ADDITIONAL CODE FROM JACKRABBIT IMPLEMENTATION
***************************

   /**
     * Always throws <code>AccessControlException</code>
     *
     * @see javax.jcr.security.AccessControlManager#setPolicy(String,
AccessControlPolicy)
     */
    public void setPolicy(String absPath, AccessControlPolicy policy) throw=
s
PathNotFoundException, AccessControlException, AccessDeniedException,
RepositoryException {
        checkInitialized();
        checkPermission(absPath, Permission.MODIFY_AC);

        throw new AccessControlException("AccessControlPolicy " + policy + =
"
cannot be applied.");
    }


********************* END OF ADDITIONAL CODE
*****************************************************************


My questions:

- Why does the code from JR implementation throw always an exception instea=
d
of trying to assign the policy? It must be a regular practice since i saw
similar always-throwing-exception methods in the same class but i must
confess that i have no idea about such behavior. By the way about this, am =
i
assigning properly the acl to grant the brand new user (User u param in the
code above) over the brand new folder (let's say "user HOME" defined by
String usersPath).

- Where can i find detailed info about Restriction class/interface? What is
exactly the meaning of such class (specifying special behavior for certain
nodes???)?

- I am accessing the repository through the shell
(java -jar jackrabbit-standalone-2.2.7.jar --cli
file:///media/Datos/Solaiemes/workspace/FileRepo/repository)
to check if my code works and so far it worked fine while testing the folde=
r
and file nodes creation. But now, when trying to check the just written
access control code, i can log in with any username (invented i mean) and
password and any action is allowed aswell for such users. I guess that such
behavior could be the default and it must be customized when developing you=
r
own solution, but so far i did not find any concrete place where to restric=
t
the access (i.e. not allowing any invented name to perform any operation an=
d
checking that the ACL i assign actually define restrictions on the nodes).

Thanks in advance!

--0016e65bbc466b6df404a8f63649--