Replication User Permissions for Pages with Closed User Groups | Community
Skip to main content
U
user06081
Level 2
August 11, 2026
Question

Replication User Permissions for Pages with Closed User Groups

  • August 11, 2026
  • 1 reply
  • 8 views

I’m trying to set up a user on the publish instance to use as the author replication/transport user.  It looks like jcr:read, rep:write, jcr:versionManagement on say /content generally work well for replication.  However, if the page has Closed User Groups configured, I am running into the following error on the publish instance during replication:

11.08.2026 18:21:57.678 *ERROR* [127.0.0.1 [1786486917674] POST /bin/receive HTTP/1.1] com.day.cq.replication.impl.servlets.ReplicationServlet Error during replication: The tree for /content/wknd/us/en/adventures/riverside-camping-australia/jcr:content does not exist
java.lang.IllegalStateException: The tree for /content/wknd/us/en/adventures/riverside-camping-australia/jcr:content does not exist
    at org.apache.jackrabbit.oak.core.MutableTree.beforeWrite(MutableTree.java:354) [org.apache.jackrabbit.oak-core:1.88.0]
    at org.apache.jackrabbit.oak.core.MutableTree.setProperty(MutableTree.java:237) [org.apache.jackrabbit.oak-core:1.88.0]
    at org.apache.jackrabbit.oak.plugins.tree.TreeUtil.addChild(TreeUtil.java:246) [org.apache.jackrabbit.oak-security-spi:1.88.0]

 

I am getting this error even if I change the /content permissions to jcr:all.

If I add the replication user to one of those closed user groups, the replication succeeds.  I don’t think it’s feasible to add the replication user to all possible closed user groups.

1 reply

Shashi_Mulugu
Community Advisor
Shashi_MuluguCommunity Advisor
Community Advisor
August 11, 2026

Hi ​@user06081 ,

​You shouldn't need a custom transport user here—the out-of-the-box replication-receiver system user on Publish is already pre-configured with the exact repository privileges and Oak exclusions needed to process incoming replications seamlessly. Using OOTB avoids managing custom transport permissions across environments.

 

Why This Error Happens?

​When Closed User Groups (CUG) are enabled on a page, Apache Jackrabbit Oak creates a rep:cugPolicy node under jcr:content. Oak treats CUG as a strict access gate: even if a user has jcr:all or rep:write granted via regular ACLs on /content, Oak denies jcr:read and write access unless that user is explicitly in the CUG or excluded from CUG evaluation. Because Oak cannot read the tree for that user, it throws the above error

 

So few solutions:

1. Use the ootb replication receiver user

2. Add the custom user you created to administrators group in publisher

3. Add the custom user to cug exclude group as below:

​On Publish, go to System Console (/system/console/configMgr).

​Open Apache Jackrabbit Oak CUG Configuration (org.apache.jackrabbit.oak.spi.security.authorization.cug.impl.CugConfiguration).

​Add your custom replication username (or group) under CUG Excluded Principals (cugExcludedPrincipals)

Terms & ConditionsAccessibility statement

Loading footer...