Preserve existing ACLs for the everyone principal

accesscontroltool-bundle/src/main/java/biz/netcentric/cq/tools/actool/configmodel/AuthorizablesConfig.java

@@ -23,6 +23,8 @@
 
 import org.apache.commons.lang3.StringUtils;
 
+import biz.netcentric.cq.tools.actool.helper.Constants;
+
 /** User and group part of the AC Tool configuration (natural ordered set of AuthorizableConfigBeans). */
 public class AuthorizablesConfig extends LinkedHashSet<AuthorizableConfigBean> {
     private static final long serialVersionUID = -253685832563496002L;
@@ -31,6 +33,10 @@ public class AuthorizablesConfig extends LinkedHashSet<AuthorizableConfigBean> {
 
     @Override
     public boolean add(AuthorizableConfigBean configBean) {
+        if (StringUtils.equals(configBean.getPrincipalName(), Constants.PRINCIPAL_EVERYONE)
+                && StringUtils.isEmpty(configBean.getUnmanagedAcePathsRegex())) {
+            configBean.setUnmanagedAcePathsRegex(".*");
+        }
         AuthorizableConfigBean previous = configBeansByPrincipalId.put(configBean.getPrincipalName(), configBean);
         assert previous == null;
         return super.add(configBean);

accesscontroltool-bundle/src/test/java/biz/netcentric/cq/tools/actool/configmodel/AuthorizablesConfigTest.java

@@ -78,6 +78,17 @@ public void testRemoveUnmanagedPrincipalNamesAtPathWithNoAutorizableBean() {
         assertEquals(principalSet("testgroupAllManaged", "nonExistentPrincipal"), removedPrincipals);
     }
 
+    @Test
+    public void testEveryoneIsUnmanagedByDefault() {
+        AuthorizablesConfig config = new AuthorizablesConfig();
+        AuthorizableConfigBean everyone = getBean("everyone", null);
+        config.add(everyone);
+
+        assertEquals(".*", everyone.getUnmanagedAcePathsRegex());
+        assertEquals(Collections.emptySet(),
+                config.removeUnmanagedPrincipalNamesAtPath("/content", principalSet("everyone"), null));
+    }
+
     @Test
     public void testRemoveUnmanagedPrincipalNamesAtPathUsingGlobalConfig() {
 

docs/AdvancedFeatures.md

@@ -332,7 +332,7 @@ To configure permissions for already existing users/groups, it's best to create
 This is not an option for the [`everyone` group](https://jackrabbit.apache.org/oak/docs/security/user/default.html#Everyone_Group) as it is neither allowed to put groups/users as members to this group (because implicitly every principal is member of this group) nor to put this group as member to another group (to prevent cycles, compare with [OAK-7323](https://issues.apache.org/jira/browse/OAK-7323)).
 Also in case of using [Sling Service Authentication bound to principals](https://sling.apache.org/documentation/the-sling-engine/service-authentication.html#service-user-mappings)(available since AEM 6.4) you cannot use group memberships, as the principal mapping does not consider (transitive) group memberships. Those mappings can be identified by looking up the according `org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended` configuration instance with its `user.mapping` property. It that has the format `<service-name>[:<subservice-name>]="["<principal name>{","<principal name>}"]"` (look for square brackets) it is a principal mapping.
 
-In those cases just list the built-in authorizable (user/group) in the YAML file (with the correct authorizable id) and leverage `unmanagedAcePathsRegex` as outlined below. No other properties need to be set on the authorizable as this is in fact not touched by the ACTool.
+In those cases just list the built-in authorizable (user/group) in the YAML file (with the correct authorizable id) and leverage `unmanagedAcePathsRegex` as outlined below. No other properties need to be set on the authorizable as this is in fact not touched by the ACTool. When `everyone` is listed without an `unmanagedAcePathsRegex`, the AC Tool defaults it to `.*` so existing ACEs for this principal are not removed. To manage selected paths for `everyone`, explicitly configure a regex that excludes all other paths.
 
 ### Configure memberships of/towards externally managed groups