Skip to content

Update AdvancedFeatures.md for authorizable management #920

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kwin merged 1 commit into from
Oct 1, 2026
Merged

Update AdvancedFeatures.md for authorizable management #920

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/AdvancedFeatures.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -332,7 +332,7 @@ To configure permissions for already existing users/groups, it's best to create
This is not an option for the [`everyone` group](https://jackrabbit.apache.org/oak/docs/security/user/default.html#Everyone_Group) as it is neither allowed to put groups/users as members to this group (because implicitly every principal is member of this group) nor to put this group as member to another group (to prevent cycles, compare with [OAK-7323](https://issues.apache.org/jira/browse/OAK-7323)).
Also in case of using [Sling Service Authentication bound to principals](https://sling.apache.org/documentation/the-sling-engine/service-authentication.html#service-user-mappings)(available since AEM 6.4) you cannot use group memberships, as the principal mapping does not consider (transitive) group memberships. Those mappings can be identified by looking up the according `org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended` configuration instance with its `user.mapping` property. It that has the format `<service-name>[:<subservice-name>]="["<principal name>{","<principal name>}"]"` (look for square brackets) it is a principal mapping.

In those cases just list the built-in authorizable (user/group) in the YAML file (with the correct authorizable id) and leverage `unmanagedAcePathsRegex` as outlined below. No other properties need to be set on the authorizable as this is in fact not touched by the ACTool.
In those cases just list the built-in authorizable (user/group) in the YAML file (with the correct authorizable id) and leverage `unmanagedAcePathsRegex` as outlined below. No other properties need to be set on the authorizable as this is in fact not touched by the ACTool. Alternatively just extend the permissions with [Repository Initialization (repoinit)][https://sling.apache.org/documentation/bundles/repository-initialization.html].

### Configure memberships of/towards externally managed groups

Expand Down
Loading