如何使用ACL權限以編程方式在aem6.2中創建用戶和組？

Question

是否有可能通過使用帶有權限的Jackrabbit用戶管理器API在AEM6.2中創建組和用戶。 我剛纔遵循以下網址，但該代碼拋出一些異常：

1. https://helpx.adobe.com/experience-manager/using/jackrabbit-users.html

2. https://stackoverflow.com/questions/38259047/how-to-give-permission-all-in-aem-through-programatically

3. ResourceResolverFactory getServiceResourceResolver throws Exception in AEM 6.1

由於getAdministrativeResourceResolver(Map)方法已不那麼如何才能我們用getServiceResourceResolver(Map) met相反。

請提供您的建議。

Answer 1

分享我的解決方案，這將有助於他人。

以下是使用getServiceResourceResolver(Map)方法用於在第一和創建組的代碼，然後用戶再添加用戶到組與ACL特權和權限：

public void createGroupUser(SlingHttpServletRequest request) { 
    String userName = request.getParameter("userName"); 
    String password = request.getParameter("password"); 
    String groupName = request.getParameter("groupName"); 

    Session session = null; 
    ResourceResolver resourceResolver = null; 
    try { 
     Map<String, Object> param = new HashMap<String, Object>(); 
     param.put(ResourceResolverFactory.SUBSERVICE, "datawrite"); 
     resourceResolver = resourceResolverFactory.getServiceResourceResolver(param); 
     session = resourceResolver.adaptTo(Session.class); 

     // Create UserManager Object 
     final UserManager userManager = AccessControlUtil.getUserManager(session); 

     // Create a Group 
     Group group = null; 
     if (userManager.getAuthorizable(groupName) == null) { 
      group = userManager.createGroup(groupName); 

      ValueFactory valueFactory = session.getValueFactory(); 
      Value groupNameValue = valueFactory.createValue(groupName, PropertyType.STRING); 
      group.setProperty("./profile/givenName", groupNameValue); 
      session.save(); 

      log.info("---> {} Group successfully created.", group.getID()); 
     } else { 
      log.info("---> Group already exist.."); 
     } 

     // Create a User 
     User user = null; 
     if (userManager.getAuthorizable(userName) == null) { 
      user = userManager.createUser(userName, password); 

      ValueFactory valueFactory = session.getValueFactory(); 
      Value firstNameValue = valueFactory.createValue("Arpit", PropertyType.STRING); 
      user.setProperty("./profile/givenName", firstNameValue); 

      Value lastNameValue = valueFactory.createValue("Bora", PropertyType.STRING); 
      user.setProperty("./profile/familyName", lastNameValue); 

      Value emailValue = valueFactory.createValue("arpit.p.bora@gmail.com", PropertyType.STRING); 
      user.setProperty("./profile/email", emailValue); 
      session.save(); 

      // Add User to Group 
      Group addUserToGroup = (Group) (userManager.getAuthorizable(groupName)); 
      addUserToGroup.addMember(userManager.getAuthorizable(userName)); 
      session.save(); 

      // set Resource-based ACLs 
      String nodePath = user.getPath(); 
      setAclPrivileges(nodePath, session); 

      log.info("---> {} User successfully created and added into group.", user.getID()); 
     } else { 
      log.info("---> User already exist.."); 
     } 

    } catch (Exception e) { 
     log.info("---> Not able to perform User Management.."); 
     log.info("---> Exception.." + e.getMessage()); 
    } finally { 
     if (session != null && session.isLive()) { 
      session.logout(); 
     } 
     if (resourceResolver != null) 
      resourceResolver.close(); 
    } 
} 

public static void setAclPrivileges(String path, Session session) { 
    try { 
     AccessControlManager aMgr = session.getAccessControlManager(); 

     // create a privilege set 
     Privilege[] privileges = new Privilege[] { 
       aMgr.privilegeFromName(Privilege.JCR_VERSION_MANAGEMENT), 
       aMgr.privilegeFromName(Privilege.JCR_MODIFY_PROPERTIES), 
       aMgr.privilegeFromName(Privilege.JCR_ADD_CHILD_NODES), 
       aMgr.privilegeFromName(Privilege.JCR_LOCK_MANAGEMENT), 
       aMgr.privilegeFromName(Privilege.JCR_NODE_TYPE_MANAGEMENT), 
       aMgr.privilegeFromName(Replicator.REPLICATE_PRIVILEGE) }; 

     AccessControlList acl; 
     try { 
      // get first applicable policy (for nodes w/o a policy) 
      acl = (AccessControlList) aMgr.getApplicablePolicies(path).nextAccessControlPolicy(); 
     } catch (NoSuchElementException e) { 
      // else node already has a policy, get that one 
      acl = (AccessControlList) aMgr.getPolicies(path)[0]; 
     } 
     // remove all existing entries 
     for (AccessControlEntry e : acl.getAccessControlEntries()) { 
      acl.removeAccessControlEntry(e); 
     } 
     // add a new one for the special "everyone" principal 
     acl.addAccessControlEntry(EveryonePrincipal.getInstance(), privileges); 

     // the policy must be re-set 
     aMgr.setPolicy(path, acl); 

     // and the session must be saved for the changes to be applied 
     session.save(); 
    } catch (Exception e) { 
     log.info("---> Not able to perform ACL Privileges.."); 
     log.info("---> Exception.." + e.getMessage()); 
    } 
} 

在代碼「datawrite」是一個服務映射是與系統用戶映射到「Apache Sling Service用戶映射程序服務」，它可在OSGI配置管理界面中配置。

有關係統用戶的安全鉸鏈，更多的細節 - How to Create System User in AEM?

Answer 2

我直接從官方Adobe頻道的培訓中提供此代碼，它基於AEM 6.1。所以我認爲這可能是最佳做法。

private void modifyPermissions() { 
    Session adminSession = null; 
    try{ 
     adminSession = repository.loginService(null, repository.getDefaultWorkspace()); 

     UserManager userMgr= ((org.apache.jackrabbit.api.JackrabbitSession)adminSession).getUserManager(); 
     AccessControlManager accessControlManager = adminSession.getAccessControlManager(); 

     Authorizable denyAccess = userMgr.getAuthorizable("deny-access"); 

     AccessControlPolicyIterator policyIterator = 
       accessControlManager.getApplicablePolicies(CONTENT_GEOMETRIXX_FR); 
     AccessControlList acl; 
     try{ 
      acl=(JackrabbitAccessControlList) policyIterator.nextAccessControlPolicy();    
     }catch(NoSuchElementException nse){ 
      acl=(JackrabbitAccessControlList) accessControlManager.getPolicies(CONTENT_GEOMETRIXX_FR)[0]; 

     } 

     Privilege[] privileges = {accessControlManager.privilegeFromName(Privilege.JCR_READ)}; 
     acl.addAccessControlEntry(denyAccess.getPrincipal(), privileges); 
     accessControlManager.setPolicy(CONTENT_GEOMETRIXX_FR, acl); 
     adminSession.save(); 
    }catch (RepositoryException e){ 
     LOGGER.error("**************************Repo Exception", e); 
    }finally{ 
     if (adminSession != null) 
      adminSession.logout(); 
    }