Unintended side effects?

[bschuhma]

HI all,

I'm trying to revoke all privileges for group everyone on /content/dam. I'm using this yaml config:

• group_config:

  • everyone:

    • name:
      path: global

• ace_config:

  • everyone:

    • path: /content/dam
      permission: deny
      privileges: jcr:all

I ran that successfully, but now ALL privileges the everyone group had appear to be gone. I wasn't expecting that. I thought I was just limiting it to /content/dam and revoking all privileges there (and only there). What happened? The log shows a lot of these:
15:29:39.139: Prefetched 338 memberships in 66ms
15:29:39.140: Created 0 authorizables (moved 0 authorizables)
15:29:39.140: Finished installation of authorizables without errors in 79ms
15:29:39.146: For paths not contained in the configuration: Cleaned 1 ACEs of path /apps/settings/wcm/template-types from all ACEs for configured authorizables
15:29:39.148: For paths not contained in the configuration: Cleaned 1 ACEs of path /etc/dam/presets/viewer from all ACEs for configured authorizables
15:29:39.151: For paths not contained in the configuration: Cleaned 1 ACEs of path /content/usergenerated/content/we-retail/us/en/community/groups/hiking from all ACEs for configured authorizables
15:29:39.153: For paths not contained in the configuration: Cleaned 1 ACEs of path /libs/dam/gui/content/reports/generatereport from all ACEs for configured authorizables
15:29:39.154: For paths not contained in the configuration: Cleaned 1 ACEs of path /oak:index from all ACEs for configured authorizables
15:29:39.156: For paths not contained in the configuration: Cleaned 1 ACEs of path /libs/dam/gui/content/nav/tools/assets/remotedamconfig from all ACEs for configured authorizables
15:29:39.158: For paths not contained in the configuration: Cleaned 1 ACEs of path /apps/public/weretail/hapi_types from all ACEs for configured authorizables
15:29:39.160: For paths not contained in the configuration: Cleaned 1 ACEs of path /etc/commerce/smartlists from all ACEs for configured authorizables
15:29:39.162: For paths not contained in the configuration: Cleaned 1 ACEs of path /libs/granite/i18n from all ACEs for configured authorizables
15:29:39.169: For paths not contained in the configuration: Cleaned 1 ACEs of path /etc from all ACEs for configured authorizables
15:29:39.172: For paths not contained in the configuration: Cleaned 1 ACEs of path /etc/cloudservices/testandtarget/defaults from all ACEs for configured authorizables
15:29:39.182: For paths not contained in the configuration: Cleaned 6 ACEs of path /conf from all ACEs for configured authorizables
15:29:39.185: For paths not contained in the configuration: Cleaned 1 ACEs of path /libs/granite/csrf/token from all ACEs for configured authorizables
15:29:39.188: For paths not contained in the configuration: Cleaned 1 ACEs of path /libs/dam/remoteassets/journal/entries from all ACEs for configured authorizables
15:29:39.190: For paths not contained in the configuration: Cleaned 1 ACEs of path /libs/settings/granite/operations from all ACEs for configured authorizables
15:29:39.192: For paths not contained in the configuration: Cleaned 1 ACEs of path /libs/granite/security/search from all ACEs for configured authorizables
15:29:39.197: For paths not contained in the configuration: Cleaned 1 ACEs of path /content/launches from all ACEs for configured authorizables
15:29:39.200: For paths not contained in the configuration: Cleaned 1 ACEs of path /content/we-retail/us/en/community/resources/en/wrt-learning-ski-3/se_enrollment from all ACEs for configured authorizables
15:29:39.202: For paths not contained in the configuration: Cleaned 1 ACEs of path /libs/wcm/foundation/components/page/responsive from all ACEs for configured authorizables
15:29:39.206: For paths not contained in the configuration: Cleaned 2 ACEs of path /content/dam/collections from all ACEs for configured authorizables
15:29:39.208: For paths not contained in the configuration: Cleaned 1 ACEs of path /libs/granite/distribution from all ACEs for configured authorizables
15:29:39.210: For paths not contained in the configuration: Cleaned 1 ACEs of path /var/commerce/payment-methods from all ACEs for configured authorizables
15:29:39.212: For paths not contained in the configuration: Cleaned 1 ACEs of path /libs/granite/offloading from all ACEs for configured authorizables
15:29:39.214: For paths not contained in the configuration: Cleaned 1 ACEs of path /libs/sling/distribution/services from all ACEs for configured authorizables

Why did it not just focus on the one, given path??

Thanks,

Bret

[kwin]

Look at https://github.com/Netcentric/accesscontroltool/blob/develop/docs/AdvancedFeatures.md#configure-unmanaged-aspects for a reasoning and how to fix this.

[bschuhma]

Thank you, Konrad! :-) Bret -- Bret Schuhmacher | Principal Architect | Adobe Systems | ***@***.******@***.***>

…

________________________________ From: Konrad Windszus ***@***.***> Sent: Monday, February 13, 2023 16:26 To: Netcentric/accesscontroltool Cc: Bret Schuhmacher; Author Subject: Re: [Netcentric/accesscontroltool] Unintended side effects? (Discussion #656) EXTERNAL: Use caution when clicking on links or opening attachments. Look at https://github.com/Netcentric/accesscontroltool/blob/develop/docs/AdvancedFeatures.md#configure-unmanaged-aspects<https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FNetcentric%2Faccesscontroltool%2Fblob%2Fdevelop%2Fdocs%2FAdvancedFeatures.md%23configure-unmanaged-aspects&data=05%7C01%7Cbschuhma%40adobe.com%7C7cd759942e464724aec908db0e08e625%7Cfa7b1b5a7b34438794aed2c178decee1%7C0%7C0%7C638119203604800775%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=Q82WSuniWoH9OkR4qPAeF2cdu%2BRcEEy8jp4VF05Fn%2FM%3D&reserved=0> for a reasoning and how to fix this. — Reply to this email directly, view it on GitHub<https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FNetcentric%2Faccesscontroltool%2Fdiscussions%2F656%23discussioncomment-4963360&data=05%7C01%7Cbschuhma%40adobe.com%7C7cd759942e464724aec908db0e08e625%7Cfa7b1b5a7b34438794aed2c178decee1%7C0%7C0%7C638119203604800775%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=7yMno26vHm0jffDbGgb%2F5qSBE%2B7jOAJ%2Fecv%2BEt%2F%2BzvE%3D&reserved=0>, or unsubscribe<https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAAUU5GHWSNK2CJALL4UKH3LWXKRGNANCNFSM6AAAAAAU2X4HXU&data=05%7C01%7Cbschuhma%40adobe.com%7C7cd759942e464724aec908db0e08e625%7Cfa7b1b5a7b34438794aed2c178decee1%7C0%7C0%7C638119203604800775%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=TgOA43j44%2F7FL4u5YwjS9HwKOK53s%2FQAqxBtXPcmFO8%3D&reserved=0>. You are receiving this because you authored the thread.Message ID: ***@***.***>

[santhoshm2651]

@kwin /Team - I have the similar kind of requirement, I have applied the deny permissions to a path when I tried to apply deny permissions for the Global for the same path in next execution all the permission created under rep:policy nodes are getting override.

So as per your suggestion I understand that the Groups created/managed in the AC Tool will be removed by AC Tool, So I have removed the Global Group from the Groups list and executed. I got the following the error.

10.04.2023 10:48:30.512 INFO [sling-default-3-UploadListener-Process-Change-ACTool-Config-Worker] biz.netcentric.cq.tools.actool.history.impl.HistoryUtils Saved history in node: /var/statistics/achistory/history_1681103910464_via_changelistener
10.04.2023 10:48:30.644 ERROR [sling-default-3-UploadListener-Process-Change] biz.netcentric.cq.tools.actool.impl.AcInstallationServiceImpl Exception in AceServiceImpl: {}
biz.netcentric.cq.tools.actool.validators.exceptions.NoGroupDefinedException: Validation error while reading ACE definition nr.1 of authorizable Global is not defined in group configuration
at biz.netcentric.cq.tools.actool.validators.impl.AceBeanValidatorImpl.validateAuthorizableId(AceBeanValidatorImpl.java:289) [biz.netcentric.cq.tools.accesscontroltool.bundle:3.0.6]
at biz.netcentric.cq.tools.actool.validators.impl.AceBeanValidatorImpl.validate(AceBeanValidatorImpl.java:77) [biz.netcentric.cq.tools.accesscontroltool.bundle:3.0.6]
at biz.netcentric.cq.tools.actool.validators.impl.AceBeanValidatorImpl.validate(AceBeanValidatorImpl.java:66) [biz.netcentric.cq.tools.accesscontroltool.bundle:3.0.6]

Please help on this query if there is any other alternative to this?