Solved
Resource resolver
Does the resource resolver object which we get from a resource or request object in a sling model has all JCR privileges(read, write, modify etc...) ??
lukasz-mAccepted solution
Community Advisor
November 1, 2022
Hi @prashanthal,
Getting resource resolver object from request/resource will have set of permissions that depend on user session that is correlated with it, e.g if anonymous user will request for specific resource, in your code for given scenario, getting resource resolver object from request will return you resource resolver with anonymous user set of privileges.
In other words set of permissions is not guarantee if you getting resource resolver object from request/resource.
If you always need specific set of permissions, you should create resource resolver object using service user. You can find more about this approach under:
- https://experienceleague.adobe.com/docs/experience-manager-65/administering/security/security-service-users.html?lang=en#priority-use-the-request-session
- great code example that shows multiple ways how you can get resource resolver object - https://github.com/Adobe-Consulting-Services/acs-aem-samples/blob/master/core/src/main/java/com/adobe/acs/samples/authentication/impl/SampleServiceLoginResourceResolverImpl.java