Permissions should not be removed for the 'everyone' principal #907

Activity

1. kwin commented on Aug 12, 2026

   

   kwin

   on Aug 12, 2026

   Last edited by kwin

   Member

   More actions

   @rombert Do you have a concern with everyone only or also other built-in principal ACLs? Everyone is a bit special as it is an artificial principal which is automatically added. Therefore maintaining membership on it does not work as outlined in https://jackrabbit.apache.org/oak/docs/security/user/default.html#Everyone_Group and also https://github.com/Netcentric/accesscontroltool/blob/develop/docs/AdvancedFeatures.md#configure-permissions-for-built-in-users-or-groups-like-anonymous. However even for other principals like anonymous one could potentially remove existing permissions.
2. anchela commented on Aug 12, 2026

   

   anchela

   on Aug 12, 2026

   More actions

   honestly, i believe this applies to all built-in groups and service principals. for groups i would see removing or revoking access on paths out of the box problematic, for service-users i would expect any change of the permission setup to be problematic and potentially leading to either non-functional behavior (revoking) or privilege escalation (additional grants). for the latter we envision making them immutable in CS, hence the push towards principal-base access control setup where we could mark the whole service user permissions as immutable at runtime.
   hope that helps

   cc: @Amoratinos
3. kwin commented on Aug 17, 2026

   

   kwin

   on Aug 17, 2026

   Member

   More actions

   @anchela Is there any way to tell built-in groups and service principal from user generated ones apart? We still need to support AEM Classic where groups/principals may have been created through different means (via CRXDE Lite, via Content Packages, via repo-init, via ACTool, via other 3rd party tools).
   I think we probably need to come up with a configurable list of principal names which are supposed to be protected or do you have any other suggestion?
4. rombert commented on Aug 20, 2026

   

   rombert

   on Aug 20, 2026

   Author

   More actions

   I think we can start with everyone and discuss how to configure the built-in principals as a follow-up.

   I can imagine that different variants and versions of AEM have different built-in principals ( e.g. a certain AEM Cloud Service releases introduces a new system user ) and that list of principals is perhaps better declared by AEM itself rather than contained in the AC tool.

   👍React with 👍1Reacted by Konrad Windszus
5. kwin

   assigned

   Copilot

   and

   kwin

   on Sep 30, 2026
6. Copilot

   linked a pull request that will close this issuePreserve existing ACLs for the everyone principal #918on Sep 30, 2026
7. kwin commented on Oct 1, 2026

   

   kwin

   on Oct 1, 2026

   Last edited by kwin

   Member

   More actions

   @rombert there is already a guard in

   accesscontroltool/accesscontroltool-bundle/src/main/java/biz/netcentric/cq/tools/actool/impl/AcInstallationServiceImpl.java

   Line 970 in eb6a227

   if (PRINCIPAL_EVERYONE.equals(authorizableId)) {

   which prevents that existing permissions bound to everyone are cleared. Do you have further insights why in your case that did not help?