From 844fa6ac37fcc71aec06ca0eb9541c3529a03e39 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 30 Sep 2026 11:25:06 +0000 Subject: [PATCH 1/2] Initial plan From af52f9fa25abce61a6fff000810c3040f328da7f Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 30 Sep 2026 11:29:25 +0000 Subject: [PATCH 2/2] Protect everyone ACLs by default Co-authored-by: kwin <185025+kwin@users.noreply.github.com> --- .../tools/actool/configmodel/AuthorizablesConfig.java | 6 ++++++ .../actool/configmodel/AuthorizablesConfigTest.java | 11 +++++++++++ docs/AdvancedFeatures.md | 2 +- 3 files changed, 18 insertions(+), 1 deletion(-) diff --git a/accesscontroltool-bundle/src/main/java/biz/netcentric/cq/tools/actool/configmodel/AuthorizablesConfig.java b/accesscontroltool-bundle/src/main/java/biz/netcentric/cq/tools/actool/configmodel/AuthorizablesConfig.java index a5aaf23a..6729b484 100644 --- a/accesscontroltool-bundle/src/main/java/biz/netcentric/cq/tools/actool/configmodel/AuthorizablesConfig.java +++ b/accesscontroltool-bundle/src/main/java/biz/netcentric/cq/tools/actool/configmodel/AuthorizablesConfig.java @@ -23,6 +23,8 @@ import org.apache.commons.lang3.StringUtils; +import biz.netcentric.cq.tools.actool.helper.Constants; + /** User and group part of the AC Tool configuration (natural ordered set of AuthorizableConfigBeans). */ public class AuthorizablesConfig extends LinkedHashSet { private static final long serialVersionUID = -253685832563496002L; @@ -31,6 +33,10 @@ public class AuthorizablesConfig extends LinkedHashSet { @Override public boolean add(AuthorizableConfigBean configBean) { + if (StringUtils.equals(configBean.getPrincipalName(), Constants.PRINCIPAL_EVERYONE) + && StringUtils.isEmpty(configBean.getUnmanagedAcePathsRegex())) { + configBean.setUnmanagedAcePathsRegex(".*"); + } AuthorizableConfigBean previous = configBeansByPrincipalId.put(configBean.getPrincipalName(), configBean); assert previous == null; return super.add(configBean); diff --git a/accesscontroltool-bundle/src/test/java/biz/netcentric/cq/tools/actool/configmodel/AuthorizablesConfigTest.java b/accesscontroltool-bundle/src/test/java/biz/netcentric/cq/tools/actool/configmodel/AuthorizablesConfigTest.java index 2d038e7a..6823ba29 100644 --- a/accesscontroltool-bundle/src/test/java/biz/netcentric/cq/tools/actool/configmodel/AuthorizablesConfigTest.java +++ b/accesscontroltool-bundle/src/test/java/biz/netcentric/cq/tools/actool/configmodel/AuthorizablesConfigTest.java @@ -78,6 +78,17 @@ public void testRemoveUnmanagedPrincipalNamesAtPathWithNoAutorizableBean() { assertEquals(principalSet("testgroupAllManaged", "nonExistentPrincipal"), removedPrincipals); } + @Test + public void testEveryoneIsUnmanagedByDefault() { + AuthorizablesConfig config = new AuthorizablesConfig(); + AuthorizableConfigBean everyone = getBean("everyone", null); + config.add(everyone); + + assertEquals(".*", everyone.getUnmanagedAcePathsRegex()); + assertEquals(Collections.emptySet(), + config.removeUnmanagedPrincipalNamesAtPath("/content", principalSet("everyone"), null)); + } + @Test public void testRemoveUnmanagedPrincipalNamesAtPathUsingGlobalConfig() { diff --git a/docs/AdvancedFeatures.md b/docs/AdvancedFeatures.md index 8d87c193..6a751e8e 100644 --- a/docs/AdvancedFeatures.md +++ b/docs/AdvancedFeatures.md @@ -332,7 +332,7 @@ To configure permissions for already existing users/groups, it's best to create This is not an option for the [`everyone` group](https://jackrabbit.apache.org/oak/docs/security/user/default.html#Everyone_Group) as it is neither allowed to put groups/users as members to this group (because implicitly every principal is member of this group) nor to put this group as member to another group (to prevent cycles, compare with [OAK-7323](https://issues.apache.org/jira/browse/OAK-7323)). Also in case of using [Sling Service Authentication bound to principals](https://sling.apache.org/documentation/the-sling-engine/service-authentication.html#service-user-mappings)(available since AEM 6.4) you cannot use group memberships, as the principal mapping does not consider (transitive) group memberships. Those mappings can be identified by looking up the according `org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended` configuration instance with its `user.mapping` property. It that has the format `[:]="["{","}"]"` (look for square brackets) it is a principal mapping. -In those cases just list the built-in authorizable (user/group) in the YAML file (with the correct authorizable id) and leverage `unmanagedAcePathsRegex` as outlined below. No other properties need to be set on the authorizable as this is in fact not touched by the ACTool. +In those cases just list the built-in authorizable (user/group) in the YAML file (with the correct authorizable id) and leverage `unmanagedAcePathsRegex` as outlined below. No other properties need to be set on the authorizable as this is in fact not touched by the ACTool. When `everyone` is listed without an `unmanagedAcePathsRegex`, the AC Tool defaults it to `.*` so existing ACEs for this principal are not removed. To manage selected paths for `everyone`, explicitly configure a regex that excludes all other paths. ### Configure memberships of/towards externally managed groups