OAK-2008 : authorization setup for closed user groups (exclude system…

… users as defined by JCR-3802) git-svn-id: https://svn.apache.org/repos/asf/jackrabbit/oak/trunk@1618123 13f79535-47bb-0310-9956-ffa450edef68
pflory · Aug 15, 2014 · 4f4a3a9 · 4f4a3a9
1 parent 49a1625
commit 4f4a3a9
Showing 1 changed file with 16 additions and 1 deletion.
diff --git a/...ug/src/main/java/org/apache/jackrabbit/oak/spi/security/authorization/cug/CugExclude.java b/...ug/src/main/java/org/apache/jackrabbit/oak/spi/security/authorization/cug/CugExclude.java
@@ -20,6 +20,10 @@
 import java.util.Set;
 import javax.annotation.Nonnull;
 
+import org.apache.jackrabbit.oak.spi.security.principal.AdminPrincipal;
+import org.apache.jackrabbit.oak.spi.security.principal.SystemPrincipal;
+import org.apache.jackrabbit.oak.spi.security.principal.SystemUserPrincipal;
+
 /**
  * CugExclude... TODO
  */
@@ -33,7 +37,18 @@ class Default implements CugExclude {
 
         @Override
         public boolean isExcluded(@Nonnull Set<Principal> principals) {
-            return principals.isEmpty();
+            if (principals.isEmpty()) {
+                return true;
+            }
+            if (principals.contains(SystemPrincipal.INSTANCE)) {
+                return true;
+            }
+            for (Principal p : principals) {
+                if (p instanceof AdminPrincipal || p instanceof SystemUserPrincipal) {
+                    return true;
+                }
+            }
+            return false;
         }
     }
 }