Difference between rep:Policy and rep:repoPolicy? | Community
Skip to main content
This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.
Best answer by Mani_kumar_
Default ACL (rep:policy)

The default access control lists are bound to individual nodes. They may be used to grant/deny access for all operations that are in some way related to JCR items: regular read/write, access control management, versioning, locking and as of Oak 1.0 user management and writing index definitions.

Repo-Level ACL (/rep:repoPolicy)

The access control lists bound to the null path can be used to grant/deny privileges associated with operations on repository-level such as namespace, node type, privilege and workspace management.

The effect of these entries is limited to the repository operations and is no inherited to any items inside the repository.

Access control policies created and modified using the default authorization model are stored as child of the node they are bound to with name rep:policy or as node with path /rep:repoPolicy (for repo-level policies).

Examples
Regular ACL at /content
"": {
    "jcr:primaryType": "rep:root",
    "content": {
        "jcr:primaryType": "oak:Unstructured",
        "jcr:mixinTypes": "rep:AccessControllable",
        "rep:policy": {
            "jcr:primaryType": "rep:ACL",
            "allow": {
                "jcr:primaryType": "rep:GrantACE",
                "rep:principalName": "jackrabbit",
                "rep:privileges": ["jcr:read", "rep:write"]
            },
            "deny": {
                "jcr:primaryType": "rep:DenyACE",
                "rep:principalName": "jackrabbit",
                "rep:privileges": ["jcr:addNodes", "rep:addProperties"],
                "rep:restrictions" {
                    "jcr:primaryType": "rep:Restrictions",
                    "rep:ntNames": ["nt:hierarchyNode", "nt:resource"]
                }
            }
        }
    }
}
Repo-Level Policy
"": {
    "jcr:primaryType": "rep:root",
    "jcr:mixinTypes": "rep:RepoAccessControllable",
    "rep:repoPolicy": {
        "jcr:primaryType": "rep:ACL",
        "allow": {
            "jcr:primaryType": "rep:GrantACE",
            "rep:principalName": "elefant",
            "rep:privileges": ["rep:privilegeManagement"]
        }
    }
}


Please refer for information
https://jackrabbit.apache.org/oak/docs/security/accesscontrol/default.html
Hope this is helpful

2 replies

K
Community Advisor
KNanCommunity Advisor
Community Advisor
November 30, 2022

Hi

 

Access control policies created and modified using the default authorization model are stored as child of the node they are bound to with name rep:policy or as node with path /rep:repoPolicy (for repo-level policies).

 

you will get more details on this url

Ref : https://jackrabbit.apache.org/oak/docs/security/accesscontrol/default.html

 

hope this help to understand.

 

Thanks

    Lokesh_Vajrala
    Community Advisor
    Lokesh_VajralaCommunity Advisor
    Community Advisor
    November 30, 2022

    @akshaybhujbale

    Additionally, you can refer to this document - https://experienceleague.adobe.com/docs/experience-manager-65/administering/security/user-group-ac-admin.html#policy-selection

    The main difference b/w the two is rep:repoPolicy applies to the repository, whereas the other associates with path.

      Mani_kumar_
      Community Advisor
      Mani_kumar_Community AdvisorAccepted solution
      Community Advisor
      November 30, 2022
      Default ACL (rep:policy)

      The default access control lists are bound to individual nodes. They may be used to grant/deny access for all operations that are in some way related to JCR items: regular read/write, access control management, versioning, locking and as of Oak 1.0 user management and writing index definitions.

      Repo-Level ACL (/rep:repoPolicy)

      The access control lists bound to the null path can be used to grant/deny privileges associated with operations on repository-level such as namespace, node type, privilege and workspace management.

      The effect of these entries is limited to the repository operations and is no inherited to any items inside the repository.

      Access control policies created and modified using the default authorization model are stored as child of the node they are bound to with name rep:policy or as node with path /rep:repoPolicy (for repo-level policies).

      Examples
      Regular ACL at /content
      "": {
    "jcr:primaryType": "rep:root",
    "content": {
        "jcr:primaryType": "oak:Unstructured",
        "jcr:mixinTypes": "rep:AccessControllable",
        "rep:policy": {
            "jcr:primaryType": "rep:ACL",
            "allow": {
                "jcr:primaryType": "rep:GrantACE",
                "rep:principalName": "jackrabbit",
                "rep:privileges": ["jcr:read", "rep:write"]
            },
            "deny": {
                "jcr:primaryType": "rep:DenyACE",
                "rep:principalName": "jackrabbit",
                "rep:privileges": ["jcr:addNodes", "rep:addProperties"],
                "rep:restrictions" {
                    "jcr:primaryType": "rep:Restrictions",
                    "rep:ntNames": ["nt:hierarchyNode", "nt:resource"]
                }
            }
        }
    }
}
      Repo-Level Policy
      "": {
    "jcr:primaryType": "rep:root",
    "jcr:mixinTypes": "rep:RepoAccessControllable",
    "rep:repoPolicy": {
        "jcr:primaryType": "rep:ACL",
        "allow": {
            "jcr:primaryType": "rep:GrantACE",
            "rep:principalName": "elefant",
            "rep:privileges": ["rep:privilegeManagement"]
        }
    }
}


      Please refer for information
      https://jackrabbit.apache.org/oak/docs/security/accesscontrol/default.html
      Hope this is helpful
        A
        akshaybhujbaleAuthor
        December 2, 2022

        Thanks @mani_kumar_

          Terms & ConditionsAccessibility statement

          Loading footer...