Permissions should not be removed for the 'everyone' principal

[rombert]

We observed a situation where permissions coming from AEM for the everyone principal were removed, leading to an outage. For example, the login page was no longer accessible.

I think the AC Tool should try to avoid making changes to built-in permissions.

[kwin]

@rombert Do you have a concern with everyone only or also other built-in principal ACLs? Everyone is a bit special as it is an artificial principal which is automatically added. Therefore maintaining membership on it does not work as outlined in https://jackrabbit.apache.org/oak/docs/security/user/default.html#Everyone_Group and also https://github.com/Netcentric/accesscontroltool/blob/develop/docs/AdvancedFeatures.md#configure-permissions-for-built-in-users-or-groups-like-anonymous. However even for other principals like anonymous one could potentially remove existing permissions.

[anchela]

honestly, i believe this applies to all built-in groups and service principals. for groups i would see removing or revoking access on paths out of the box problematic, for service-users i would expect any change of the permission setup to be problematic and potentially leading to either non-functional behavior (revoking) or privilege escalation (additional grants). for the latter we envision making them immutable in CS, hence the push towards principal-base access control setup where we could mark the whole service user permissions as immutable at runtime.
hope that helps

cc: @Amoratinos

[kwin]

@anchela Is there any way to tell built-in groups and service principal from user generated ones apart? We still need to support AEM Classic where groups/principals may have been created through different means (via CRXDE Lite, via Content Packages, via repo-init, via ACTool, via other 3rd party tools).
I think we probably need to come up with a configurable list of principal names which are supposed to be protected or do you have any other suggestion?

[rombert]

I think we can start with everyone and discuss how to configure the built-in principals as a follow-up.

I can imagine that different variants and versions of AEM have different built-in principals ( e.g. a certain AEM Cloud Service releases introduces a new system user ) and that list of principals is perhaps better declared by AEM itself rather than contained in the AC tool.