title: Trouble enforcing read-write ACL to Jackrabbit users on versionable nodes
body: <p>We are using Jackrabbit 2.2.7 to develop a repository for xml documents.</p>
  
  <p>We want to create a bunch of users for the repository and enforce some sort of read-only and read-write access privileges on them. We have used the resource based ACL as described <a href="http://wiki.apache.org/jackrabbit/AccessControl#Resource-based_ACLs" rel="nofollow">here</a>. Read-only permission works as charm. However, we are having hard time getting read-write to work when a user attempts to create/delete a node that is versionable (<code>mix:versionable</code>), even though we grant him the highest possible privilege, <code>Privilege.JCR_ALL</code>. So far we have realized that the modification to a versioned node actually is not simple. In Jackrabbit, it span across multiple  nodes - <code>/jcr:system/jcr:versionStorage</code> is one of them. It seems that unless the user is the admin user himself, he cannot make modification to <code>/jcr:system/</code> and its child nodes.</p>
  
  <p>So my questions are</p>
  
  <ul>
  <li>a) is there a way I enable normal users to modify versionable nodes?</li>
  <li>b) is there a way to create multiple admin users in jackrabbit (pointers, wiki, code snippet)? </li>
  </ul>
  
  <p>Here is the security section from the <code>repository.xml</code>: </p>
  
  <pre><code>&lt;Security appName="Jackrabbit"&gt;
      &lt;SecurityManager class="org.apache.jackrabbit.core.DefaultSecurityManager" 
          workspaceName="security"&gt;
          &lt;!-- &lt;WorkspaceAccessManager class="..."/&gt; --&gt;
          &lt;!-- &lt;param name="config" value="${rep.home}/security.xml"/&gt; --&gt;
      &lt;/SecurityManager&gt;
  
      &lt;AccessManager 
          class="org.apache.jackrabbit.core.security.DefaultAccessManager"&gt;
          &lt;!-- &lt;param name="config" value="${rep.home}/access.xml"/&gt; --&gt;
      &lt;/AccessManager&gt;
  
      &lt;LoginModule 
          class="org.apache.jackrabbit.core.security.authentication.DefaultLoginModule"&gt;
         &lt;!--
            anonymous user name ('anonymous' is the default value)
          --&gt;
         &lt;param name="anonymousId" value="anonymous"/&gt;
         &lt;!--
            administrator user id (default value if param is missing is 'admin')
          --&gt;
         &lt;param name="adminId" value="admin"/&gt;
      &lt;/LoginModule&gt;
  &lt;/Security&gt;
  </code></pre>
  
  <p>Here is how we are creating users and enabling access control:</p>
  
  <pre><code>    {
          ...
          JackrabbitSession js = (JackrabbitSession) session;
          UserManager um = js.getUserManager();
          Authorizable grp = um.getAuthorizable("usergroup");
          Group userGroup = null;
          if(grp == null){
              userGroup = um.createGroup("usergroup");
          }else{
              userGroup = (Group) grp;
          }
  
          User user = um.createUser(newUserName, newUserPass);
          userGroup.addMember(user);
  
          Node node = session.getNode("/root");           
  
          AccessControlManager acm = session.getAccessControlManager();
          AccessControlList acl = getList(acm, node.getPath());
  
          Privilege[] privileges = null ;
          if(privilege.equals("r")){
  
              privileges = new Privilege[]
              {
                  acm.privilegeFromName(Privilege.JCR_READ),
                  acm.privilegeFromName(Privilege.JCR_LOCK_MANAGEMENT)
              };
  
          }else if(privilege.equals("rw")){
              privileges = new Privilege[]
              {
  
                  acm.privilegeFromName(Privilege.JCR_ALL)
              };
          }else{
  
              return;
          }
          acl.addAccessControlEntry(new PrincipalImpl(user.getID()), privileges);
          acm.setPolicy(node.getPath(), acl);
  
          session.save();
   }
  </code></pre>