net.adamcin.oakpal.core.checks

Class ExpectAces

java.lang.Object

net.adamcin.oakpal.core.checks.ExpectAces

All Implemented Interfaces:

net.adamcin.oakpal.api.ProgressCheckFactory

public final class ExpectAces
extends Object
implements net.adamcin.oakpal.api.ProgressCheckFactory

ExpectAces: assert the existence or non-existence of specific access control entries after extracting a package. config options:

principal

(String) REQUIRED (or principals): The expected principal name (userId or groupId) associated with all the ace criteria. Takes precendence over principals unless set to the empty string.

principals

(String[]) REQUIRED (or principal): The expected principal names (userId or groupId) associated with all the ace criteria. This is essentially shorthand for cases where the same aces policies apply to multiple principals.

expectedAces

(String[]) A list of expected ACE criteria including type, privileges, and path, as well as restriction constraints. See below for syntax.

notExpectedAces

(String[]) A list of non-expected ACE criteria including type, privileges, and path, as well as restriction constraints. See below for syntax.

afterPackageIdRules

(Rule[]) An optional list of patterns describing the scope of package IDs that should trigger evaluation of ACLs after extraction. By default, the expectations will be evaluated after every package is installed.

ignoreNestedPackages

(since 2.2.2) By default, expectations are evaluated for all packages matching the afterPackageIdRules. Set this to true to only evaluate after extracting and again after scanning a matching root package.

severity

By default, the severity of violations created by this check is MAJOR, but can be set to MINOR or SEVERE.

rep:policy nodes are imported differently from normal DocView content. Instead of having a predictable path, they are potentially merged and renamed depending on existing rep:GrantACE or rep:DenyACE children of the rep:policy. Therefore, we have a special check that evaluates the presence of expected rules based on their attributes, instead of their own paths within a package.

Finer-grained Access Control Handling Policies like MERGE and MERGE_PRESERVE operate along lines defined by the principal identified by a particular ACE. Therefore, this check requires that you specific a specific principal to expect aces for.

The syntax for expectedAces and notExpectedAces is similar to that used by ACS AEM Commons for OSGi config definitions. type=allow;privileges=jcr:read,rep:write;path=/content/foo;rep:glob=/jcr:content/*

REQUIRED

• type = allow | deny
• privileges = privilegeNames comma separated
• path = absolute path (must exist in JCR). If not specified, or the empty string, the ace criteria are evaluated against /rep:repoPolicy.

OPTIONAL

• principal = overrides the check config principal parameter for this particular ACE
• rep:glob = rep glob expression
• rep:ntNames = ntNames expression
• rep:nodePath = for system users, aces defined in the user home can reference applicable repo path using this restriction
• anyOtherRestriction = any name can be used as a restriction constraint. if the restriction is not allowed for use at a particular path, it will be ignored.

Note - restrictions with comma-separated values are evaluated as multivalued when the restriction definition so indicates. Otherwise the comma-separated values are treated as an opaque string.

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
static interface	ExpectAces.JsonKeys

Field Summary

Fields

Modifier and Type	Field and Description
static String	ACE_PARAM_PATH Deprecated.
static String	ACE_PARAM_PRIVILEGES Deprecated.
static String	ACE_PARAM_TYPE Deprecated.
static String	CONFIG_AFTER_PACKAGE_ID_RULES Deprecated.
static String	CONFIG_EXPECTED_ACES Deprecated.
static String	CONFIG_NOT_EXPECTED_ACES Deprecated.
static String	CONFIG_PRINCIPAL Deprecated.
static String	CONFIG_PRINCIPALS Deprecated.
static String	DELIM_LIST
static String	DELIM_PARAM
static String	DELIM_VALUE

Constructor Summary

Constructors

Constructor and Description
ExpectAces()

Method Summary

Modifier and Type	Method and Description
static @NotNull ExpectAces.JsonKeys	keys()
net.adamcin.oakpal.api.ProgressCheck	newInstance(javax.json.JsonObject config)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

CONFIG_PRINCIPAL

@Deprecated
public static final String CONFIG_PRINCIPAL

Deprecated.

CONFIG_PRINCIPALS

@Deprecated
public static final String CONFIG_PRINCIPALS

Deprecated.

CONFIG_EXPECTED_ACES

@Deprecated
public static final String CONFIG_EXPECTED_ACES

Deprecated.

CONFIG_NOT_EXPECTED_ACES

@Deprecated
public static final String CONFIG_NOT_EXPECTED_ACES

Deprecated.

CONFIG_AFTER_PACKAGE_ID_RULES

@Deprecated
public static final String CONFIG_AFTER_PACKAGE_ID_RULES

Deprecated.

ACE_PARAM_TYPE

@Deprecated
public static final String ACE_PARAM_TYPE

Deprecated.

ACE_PARAM_PRIVILEGES

@Deprecated
public static final String ACE_PARAM_PRIVILEGES

Deprecated.

ACE_PARAM_PATH

@Deprecated
public static final String ACE_PARAM_PATH

Deprecated.

DELIM_PARAM

public static final String DELIM_PARAM

See Also:

Constant Field Values

DELIM_VALUE

public static final String DELIM_VALUE

See Also:

Constant Field Values

DELIM_LIST

public static final String DELIM_LIST

See Also:

Constant Field Values

Constructor Detail

ExpectAces

public ExpectAces()

Method Detail

keys

@NotNull
public static @NotNull ExpectAces.JsonKeys keys()

newInstance

public net.adamcin.oakpal.api.ProgressCheck newInstance(javax.json.JsonObject config)
                                                 throws Exception

Specified by:

newInstance in interface net.adamcin.oakpal.api.ProgressCheckFactory

Throws:

Exception