Hi Marco Depending on what you wish to achieve the restrictions may help. I am not sure if fully understood what you are aiming for so it's a bit hard to tell if restrictions will really do the trick.
Depending on the actual needs and how well your access control requirements fit into the default authorization model, it might be worth exploring the ability to provide a custom authorization setup. If you find yourself struggling to map your needs to a setup using the default authorization, exploring a custom implementation might be worth the effort and might also end up being more efficient in terms of maintaining the setup and evaluation performance... but it really depends on the details. In case you wish to explore that option, you will find some simplistic examples/exercises in the oak-exercise module. The same exercise module also provides a few exercise lessons for restrictions and how to write a custom restriction provider. Obviously that's a lot easier that writing a custom authorization model. Hope that helps Angela ________________________________ From: Marco Piovesana <[email protected]> Sent: Wednesday, February 26, 2020 9:13 AM To: [email protected] <[email protected]> Subject: custom restrictions on ACEs Hi all, I have an application where the ACEs (Access Control Entries) are applied to a node by users and by the system itself. By the user when she/he wants to share the node with some other users, by the system when the node has to be available to some users in automatic, under specific conditions. The user should not be able to modify an ACE added by the system. Right now, when I read the ACL, I can't tell what ACE has been created by the user and what has been created by the system. Reading the documentation I saw that one possible solution might be using custom restrictions <https://jackrabbit.apache.org/oak/docs/security/authorization/restriction.html> when creating the ACE, but I'm not sure this is one of the intended usage for the restrictions. Is there a better solution for this problem? Marco.
