Mailing-List: contact users-help@jackrabbit.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@jackrabbit.apache.org
Received-SPF: softfail (nike.apache.org: transitioning domain of
 polisettya@gmail.com does not designate 216.139.250.139 as permitted sender)
Date: Fri, 20 Sep 2013 04:42:41 -0700 (PDT)
From: anjan <polisettya@gmail.com>
To: users@jackrabbit.apache.org
Message-ID: <1379677361253-4659561.post@n4.nabble.com>
Subject: Group membership and Privileges
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

I have a node (of type nt:folder) where the below privileges are granted for
the user "test".

jcr:primaryType = rep:GrantACE
rep:privileges    =   
['jcr:modifyProperties','jcr:read','jcr:versionManagement'].

Now I am able to create a child node (of type nt:folder) successfully with
"test" user even though "test" user doesn't have the "jcr:addChildNodes"
privilege.

This "test" user also belong to "administrator" group and I believe this
group has "jcr:all" privileges assigned to it.

But based on my understanding, if ACEs are defined for USER principal they
will take precedence over the group principals.  So I am not sure how "test"
user can successfully create a child node.  Am I missing something here?  


--
View this message in context: http://jackrabbit.510166.n4.nabble.com/Group-membership-and-Privileges-tp4659561.html
Sent from the Jackrabbit - Users mailing list archive at Nabble.com.