Mailing-List: contact users-help@jackrabbit.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@jackrabbit.apache.org
MIME-Version: 1.0
In-Reply-To: <1386901001181-4660065.post@n4.nabble.com>
References: <1386670897909-4660059.post@n4.nabble.com>
	<1386844345098-4660063.post@n4.nabble.com>
	<CAB+dfim394Mr-B6punM1bbCmRWbfht3p3L4cifUfNMHFGbHUJQ@mail.gmail.com>
	<1386901001181-4660065.post@n4.nabble.com>
Date: Thu, 12 Dec 2013 21:26:33 -0800
Message-ID: 
 <CAB+dfimNvCT4PS51k08vKgcJKOKOBPiJHQ3nRdnRAithH88gKQ@mail.gmail.com>
Subject: Re: Group membership is not honoured?
From: Tobias Bocanegra <tripod@apache.org>
To: "users@jackrabbit.apache.org" <users@jackrabbit.apache.org>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

so when I format it a bit nicer:

then /content/child has:

    "Managers": {
        "denied": [
            "jcr:removeNode",
            "jcr:modifyAccessControl",
            "jcr:versionManagement",
            "jcr:nodeTypeManagement",
            "jcr:modifyProperties",
            "jcr:addChildNodes"
        ],
        "granted": [
            "jcr:read"
        ],
        "order": 0,
        "principal": "Managers"
    },
    "everyone": {
        "denied": [
            "jcr:read"
        ],
        "order": 1,
        "principal": "everyone"
    }
}

which denies everyone read after you allow read for managers. since
all users are automatically member of "everyone" your user can't see
"child".
you need to move the 'everyone deny' up to the first position.

regards, toby

On Thu, Dec 12, 2013 at 6:16 PM, anjan <polisettya@gmail.com> wrote:
> Hi Toby, thank you for your response.  I was also under the same impressi=
on
> that the order of ACEs matter.  I posted the JSON dumps in my previous po=
sts
> also.  Anyway, here are how the ACLs setup at each level (JSON dumps).
>
> *Root folder:*
> {"administrators":{"principal":"administrators","granted":["jcr:all"],"or=
der":0},"everyone":{"principal":"everyone","granted":["jcr:read","jcr:readA=
ccessControl"],"order":1}}
>
> *"content" folder (Child of Root folder):*
> {"everyone":{"principal":"everyone","granted":["jcr:removeChildNodes","jc=
r:read"],"order":0}}
>
> *"child" folder (Child of content folder):*
> {"Managers":{"principal":"Managers","granted":["jcr:read"],"denied":["jcr=
:removeNode","jcr:modifyAccessControl","jcr:versionManagement","jcr:nodeTyp=
eManagement","jcr:modifyProperties","jcr:addChildNodes"],"order":0},"everyo=
ne":{"principal":"everyone","denied":["jcr:read"],"order":1}}
>
> You can see "order" attribute in the JSON responses.  Clearly "Managers" =
is
> ordered at 0 and everyone is ordered at 1 for "test" folder.  But the use=
r
> who belongs to "Managers" group cannot see this "child" folder.
>
>
>
> --
> View this message in context: http://jackrabbit.510166.n4.nabble.com/Grou=
p-membership-is-not-honoured-tp4660059p4660065.html
> Sent from the Jackrabbit - Users mailing list archive at Nabble.com.