Angela Schreiber created OAK-10224:
--------------------------------------
Summary:
org.apache.jackrabbit.api.security.user.QueryBuilder.impersonates is not
aligned with Impersonation.allows
Key: OAK-10224
URL: https://issues.apache.org/jira/browse/OAK-10224
Project: Jackrabbit Oak
Issue Type: Improvement
Components: jackrabbit-api
Reporter: Angela Schreiber
while discussing the improvements suggested by [~antoniu98] in OAK-10173 we
found that the API definition of
{{org.apache.jackrabbit.api.security.user.QueryBuilder.impersonates(String
name)}} is not really aligned with {{Impersonation.allows(Subject)}}.
while for the current implementation this doesn't matter as only the admin user
is able to impersonate everyone irrespective of the information stored in
rep:impersonators properties, we can only make a best-effort guess on whether
the specified principal name might result upon login in a subject that contains
any of the configure impersonators principals.
ultimately, i would be desirable if there was a way to pass a subject to
{{org.apache.jackrabbit.api.security.user.QueryBuilder.impersonates}} (or
something equivalent) in order to make it properly aligned with
{{Impersonation.allows(Subject)}}.
note that expanding the API would also require adjusting
https://github.com/apache/jackrabbit/blob/trunk/jackrabbit-jcr-commons/src/main/ja[…]ackrabbit/commons/jackrabbit/user/AuthorizableQueryManager.java.
cc: [~antoniu98] FYI
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
