RE: user management - why bother?

Noel J. Bergman wrote:
> Roland Weber wrote:

JEE container managed security does not cover instance based authorization,
and would not address which part(s) of a gallery a given entity can access.

> > permission checking should be left to the backend if
> > possible. I don't know what JCR offers for that at
> > the moment.

From the docs:

  How do I manage the access rights of authenticated users?

  The current JackrabbitSimpleAccessManager class only supports
  three access levels: anonymous, normal, and system. Anonymous
  users have read access while normal and system users have full
  read-write access. You need to implement a custom AccessManager
  class to get more fine-grained access control.

q.v.
http://jackrabbit.apache.org/api-1/org/apache/jackrabbit/core/security/Acces
sManager.html
     http://markmail.org/message/cc3lgit3fff5gcse

	--- Noel