java - 管理 Jackrabbit 组 ACL。访问被拒绝在具有组权限的节点上添加节点

Question

在 jackrabbit 存储库中，我正在尝试向组添加权限。我想要什么“设计师”组可以写入/templates 节点。

此节点(/templates)是类型为 nt:folder 的节点

首先，我创建一个名为“设计师”的群组

userManager = jkSession.getUserManager();

        Roles[] rolesTable = { Roles.EDITOR, Roles.DESIGNER,
                Roles.OPERATOR, Roles.ADMINISTRATOR };

        for (Roles role : rolesTable) {


                userManager.createGroup(role.toString());

            ...

并为/templates 节点的该组分配权限:

    p = principalManager.findPrincipals(
                                Roles.DESIGNER.toString(),
                                PrincipalManager.SEARCH_TYPE_GROUP)
                                .nextPrincipal();
    Node catalogNode = session.getRootNode().getNode("templates");

                AccessControlPolicyIterator accessControlPolicyIterator = accessControlManager
                        .getApplicablePolicies(catalogNode.getPath());

    AccessControlPolicy policy = accessControlPolicyIterator
                                .nextAccessControlPolicy();

                        if (polic

y instanceof AccessControlList) {

                        AccessControlList acl = (AccessControlList) policy;

                        JackrabbitAccessControlList jackAcl = (JackrabbitAccessControlList) acl;
                        jackAcl
                                .addEntry(
                                        p,
                                        new Privilege[] {
                                                accessControlManager
                                                        .privilegeFromName(Privilege.JCR_ADD_CHILD_NODES),
                                                accessControlManager
                                                        .privilegeFromName(Privilege.JCR_READ),
                                                accessControlManager
                                                        .privilegeFromName(Privilege.JCR_WRITE),
                                                accessControlManager
                                                        .privilegeFromName(Privilege.JCR_REMOVE_NODE) },
                                        true, null);

现在，创建用户并使其成为设计师组的成员:

    Principal principal = principalManager.findPrincipals(DESIGNER.toString(),
            PrincipalManager.SEARCH_TYPE_GROUP).nextPrincipal();
Group roleToAssign = (Group) userManager.getAuthorizable(principal);

        user = userManager.createUser(login, password);

        roleToAssign.addMember(user);

现在使用该用户登录并尝试将Node添加到/templates

lCredentials = new SimpleCredentials(login, new String(pPassword)
                    .toCharArray());
        }

        Repository tmpRepository = null;

        try {
            tmpRepository = repositoryFactory.getRepository(repositoryParams);
            session = tmpRepository.login(lCredentials, pWorkspace);

并将节点添加到/templates:

session.getRootNode().getNode("templates").addNode("test","nt:unstructed");

但是抛出 accessDenied:

javax.jcr.AccessDeniedException: Access denied.
    at org.apache.jackrabbit.core.security.DefaultAccessManager.checkPermission(DefaultAccessManager.java:193)
    at org.apache.jackrabbit.core.NodeImpl.addNode(NodeImpl.java:1266)
    at org.apache.jackrabbit.core.session.AddNodeOperation.perform(AddNodeOperation.java:111)
    at org.apache.jackrabbit.core.session.AddNodeOperation.perform(AddNodeOperation.java:37)
    at org.apache.jackrabbit.core.session.SessionState.perform(SessionState.java:216)
    at org.apache.jackrabbit.core.ItemImpl.perform(ItemImpl.java:91)
    at org.apache.jackrabbit.core.NodeImpl.addNodeWithUuid(NodeImpl.java:1814)
    at org.apache.jackrabbit.core.NodeImpl.addNode(NodeImpl.java:1774)
    at org.apache.jackrabbit.commons.JcrUtils.getOrAddNode(JcrUtils.java:519)

我没有找到有关 jackrabbits 组的 ACL 的文档。请有人帮助我吗？谢谢。

Answer 1

已修复。

对于主体(组或用户)的权限，必须使用基于主体的 ACL，而不是像我在这篇文章中那样使用资源 ACL。

主基 ACL 的描述如下:

Jackrabbit ACL (是的，这篇文章是 RTFM 案例)

但是另外需要在权限列表中添加权限JCR_NODE_TYPE_MANAGEMENT才能添加特定类型的子节点。

    privileges = new Privilege[] {
                                    accessControlManager
                                            .privilegeFromName(Privilege.JCR_ADD_CHILD_NODES),
                                    accessControlManager
                                            .privilegeFromName(Privilege.JCR_READ),
                                    accessControlManager
                                            .privilegeFromName(Privilege.JCR_WRITE),
                                    accessControlManager
                                            .privilegeFromName(Privilege.JCR_NODE_TYPE_MANAGEMENT) };

谢谢。