Package org.apache.jackrabbit.core.security.user

Class UserManagerImpl

  • All Implemented Interfaces:
    UserManager, SessionListener
    Direct Known Subclasses:
    UserPerWorkspaceUserManager
    public class UserManagerImpl
extends ProtectedItemModifier
implements UserManager, SessionListener

    Implementation Characteristics

    Default implementation of the UserManager interface with the following characteristics:
    • Users and Groups are stored in the repository as JCR nodes.
    • Users are created below UserConstants.USERS_PATH,
      Groups are created below UserConstants.GROUPS_PATH (unless otherwise configured).
    • The Id of an authorizable is stored in the jcr:uuid property (md5 hash).
    • In order to structure the users and groups tree and avoid creating a flat hierarchy, additional hierarchy nodes of type "rep:AuthorizableFolder" are introduced using
      • the specified intermediate path passed to the create methods
      • or some built-in logic if the intermediate path is missing.

    Authorizable Creation

    The built-in logic applies the following rules:
    • The names of the hierarchy folders is determined from ID of the authorizable to be created, consisting of the leading N chars where N is the relative depth starting from the node at getUsersPath() or getGroupsPath().
    • By default 2 levels (depth == 2) are created.
    • Parent nodes are expected to consist of folder structure only.
    • If the ID contains invalid JCR chars that would prevent the creation of a Node with that name, the names of authorizable node and the intermediate hierarchy nodes are escaped.
    Examples: Creating an non-existing user with ID 'aSmith' without specifying an intermediate path would result in the following structure: 
     + rep:security            [nt:unstructured]
   + rep:authorizables     [rep:AuthorizableFolder]
     + rep:users           [rep:AuthorizableFolder]
       + a                 [rep:AuthorizableFolder]
         + aS              [rep:AuthorizableFolder]
           + aSmith        [rep:User]
    Creating a non-existing user with ID 'aSmith' specifying an intermediate path 'some/tree' would result in the following structure: 
     + rep:security            [nt:unstructured]
   + rep:authorizables     [rep:AuthorizableFolder]
     + rep:users           [rep:AuthorizableFolder]
       + some              [rep:AuthorizableFolder]
         + tree            [rep:AuthorizableFolder]
           + aSmith        [rep:User]

    Configuration

    This UserManager is able to handle the following configuration options:

    Configuration Parameters

    • PARAM_USERS_PATH: Defines where user nodes are created. If missing set to USERS_PATH.
    • PARAM_GROUPS_PATH. Defines where group nodes are created. If missing set to GROUPS_PATH.
    • PARAM_COMPATIBLE_JR16: If the param is present and its value is true looking up authorizables by ID will use the NodeResolver if not found otherwise.
      If the parameter is missing (or false) users and groups created with a Jackrabbit repository < v2.0 will not be found any more.
      By default this option is disabled.
    • PARAM_DEFAULT_DEPTH: Parameter used to change the number of levels that are used by default to store authorizable nodes.
      The value is expected to be a positive integer greater than zero. The default number of levels is 2.
    • PARAM_AUTO_EXPAND_TREE: If this parameter is present and its value is true, the trees containing user and group nodes will automatically created additional hierarchy levels if the number of nodes on a given level exceeds the maximal allowed size.
      By default this option is disabled.
    • PARAM_AUTO_EXPAND_SIZE: This parameter only takes effect if PARAM_AUTO_EXPAND_TREE is enabled.
      The value is expected to be a positive long greater than zero. The default value is 1000.
    • PARAM_GROUP_MEMBERSHIP_SPLIT_SIZE: If this parameter is present group memberships are collected in a node structure below UserConstants.N_MEMBERS instead of the default multi valued property UserConstants.P_MEMBERS. Its value determines the maximum number of member properties until additional intermediate nodes are inserted. Valid parameter values are integers > 4.
    • PARAM_PASSWORD_HASH_ALGORITHM: Optional parameter to configure the algorithm used for password hash generation. The default value is PasswordUtility.DEFAULT_ALGORITHM.
    • PARAM_PASSWORD_HASH_ITERATIONS: Optional parameter to configure the number of iterations used for password hash generations. The default value is PasswordUtility.DEFAULT_ITERATIONS.

    Authorizable Actions

    In addition to the specified configuration parameters this user manager implementation allows to define zero to many AuthorizableActions. Authorizable actions provide the ability to execute additional validation or tasks upon authorizable creation, removal and upon changing a users password.
    See also UserManagerConfig.getAuthorizableActions()