Unlocking a page with system user

Where can I grant "jcr:lockManagement" to my system user and on my specific content path?

I see no way of doing it in /useradmin Permissions tab of my user.

Thanks again

If you follow ACLs on "admin" user, you can clearly notice that it has "jcr:lockManagement"  that's why admin user can unlock any other user's locks.

I doubt that the custom system user has that kind of granular access to each path in repo. Debug and you would find it out.  I assume that would work with getAdministrativeResourceResolver("admin, "admin, <path>); and not with getAdministrativeResourceResolver(null);

I will, try but not quite optimistic because as a stated earlier:

- before asking the question in this forum, I made a quick attempt using the deprecated getAdministrativeResourceResolver(null); to get an admin session (who according to documentation should be able to unlock everything), but unlocking failed because page.canUnlock() returned false. Even under admin session!!?

Interesting - in my test - I used the same system used to lock and unlock. Never really thought about using 2 different system users.

Look at Gaurav's suggestion.

You could add that system user to the "admin" group or otherwise grant "jcr:lockManagement" and potentially, "jcr:versionManagement", "jcr:modifyAccessControl" ACLs to that system-user on that specific content path. That ways the system user would behave as "admin" for that content path. Follow "admin" user's ACLs and provide the same to system user in a restricted way.

Hi, I tested and confirmed that a "system user" cannot unlock a page unless he owns the lock, no matter the permissions I give to him.

He owns the lock only if he did the locking, in which case he can unlock.

We are using version 6.2

This is a problem!! can you please advise

Thanks

Thank you for the detailed reply!

A few things again about my case:

- the user who locks the page is the workflow initiator, NOT a system user

- my code needs to unlock the pages, no matter who did lock them.

- I'm not sure if in your example, you mapped a different user when unlocking under your "datapersist" subServiceName

- before asking the question in this forum, I made a quick attempt using the deprecated getAdministrativeResourceResolver(null); to get an admin session (who according to documentation should be able to unlock everything), but unlocking failed because page.canUnlock() returned false. Even under admin session!!?

I will try giving my system user just read/write permissions to that area of JCR, and will let you know how it goes.

Thanks again

For you question about permissions needed by System user - simply give that system user read/write permissions to that part of the JCR. 

Also - when i open the locked page (locked via code) -- i see a lock icon and I am unable to modify the page.

I have worked with the Page Manager API to test this use case.

First Lock API works.

Code that uses a System User:

import org.apache.sling.settings.SlingSettingsService;

import org.osgi.service.component.annotations.Activate;

import org.osgi.service.component.annotations.Component;

import org.osgi.service.component.annotations.ConfigurationPolicy;

import org.osgi.service.component.annotations.Reference;

import org.osgi.service.metatype.annotations.Designate;

import java.util.HashMap;

import java.util.Map;

import javax.jcr.Node;

import javax.jcr.Session;

import org.apache.jackrabbit.commons.JcrUtils;

import org.apache.sling.api.resource.LoginException;

import org.apache.sling.api.resource.ResourceResolver;

import org.apache.sling.api.resource.ResourceResolverFactory;

import com.adobe.cq.sightly.WCMUsePojo;

import com.day.cq.commons.jcr.JcrConstants;

import com.day.cq.wcm.api.Page;

import com.day.cq.wcm.api.PageManager;

import org.apache.sling.api.resource.Resource;

import org.slf4j.Logger;

import org.slf4j.LoggerFactory;

@Component

public class PageServiceImp implements PageService {

private final Logger logger = LoggerFactory.getLogger(getClass());

private String user = "";

    private Session session;

    //Inject a Sling ResourceResolverFactory

    @Reference

    private ResourceResolverFactory resolverFactory;

    public String MovePage()

    {

    String pagePath = "/content/MovePage64/fr";

    String newPagePath ="/content/MovePage64/en" ;

    String templatePath = "/apps/AEMPage/templates/page-home";

    String pageTitle = "AEM home page";

    Page newPage;

    PageManager pageManager;

    ResourceResolver resolver = null;

     String newPageName = "";  

     Map<String, Object> param = new HashMap<String, Object>();

     param.put(ResourceResolverFactory.SUBSERVICE, "datapersist");

       try {

           //Invoke the adaptTo method to create a Session used to create a QueryManager

           resolver = resolverFactory.getServiceResourceResolver(param);

        Resource res = resolver.getResource(pagePath);   

        //Adapts the resource to another type - in this example to a     com.day.cq.wcm.api.page

         Page page = res.adaptTo(Page.class);

       //Lock this page

       page.lock(); 

       logger.info("The page is locked!");

         // session = resolver.adaptTo(Session.class);

        return ""

    } catch (Exception e) {

        // TODO Auto-generated catch block

        logger.info("&&&&& BIG ERROR" +e.getMessage());

    }

    return ""  ;

}

}

The result is the page is locked:

Second the UnLock API works.

Code that uses a System User:

import org.apache.sling.settings.SlingSettingsService;

import org.osgi.service.component.annotations.Activate;

import org.osgi.service.component.annotations.Component;

import org.osgi.service.component.annotations.ConfigurationPolicy;

import org.osgi.service.component.annotations.Reference;

import org.osgi.service.metatype.annotations.Designate;

import java.util.HashMap;

import java.util.Map;

import javax.jcr.Node;

import javax.jcr.Session;

import org.apache.jackrabbit.commons.JcrUtils;

import org.apache.sling.api.resource.LoginException;

import org.apache.sling.api.resource.ResourceResolver;

import org.apache.sling.api.resource.ResourceResolverFactory;

import com.adobe.cq.sightly.WCMUsePojo;

import com.day.cq.commons.jcr.JcrConstants;

import com.day.cq.wcm.api.Page;

import com.day.cq.wcm.api.PageManager;

import org.apache.sling.api.resource.Resource;

import org.slf4j.Logger;

import org.slf4j.LoggerFactory;

@Component

public class PageServiceImp implements PageService {

private final Logger logger = LoggerFactory.getLogger(getClass());

private String user = "";

    private Session session;

    //Inject a Sling ResourceResolverFactory

    @Reference

    private ResourceResolverFactory resolverFactory;

    public String MovePage()

    {

    String pagePath = "/content/MovePage64/fr";

    String newPagePath ="/content/MovePage64/en" ;

    String templatePath = "/apps/AEMPage/templates/page-home";

    String pageTitle = "AEM home page";

    Page newPage;

    PageManager pageManager;

    ResourceResolver resolver = null;

     String newPageName = "";  

     Map<String, Object> param = new HashMap<String, Object>();

     param.put(ResourceResolverFactory.SUBSERVICE, "datapersist");

       try {

           //Invoke the adaptTo method to create a Session used to create a QueryManager

           resolver = resolverFactory.getServiceResourceResolver(param);

        Resource res = resolver.getResource(pagePath);   

        //Adapts the resource to another type - in this example to a     com.day.cq.wcm.api.page

         Page page = res.adaptTo(Page.class);

       //Lock this page

       page.unlock(); 

       logger.info("The page is locked!");

         // session = resolver.adaptTo(Session.class);

        return ""

    } catch (Exception e) {

        // TODO Auto-generated catch block

        logger.info("&&&&& BIG ERROR" +e.getMessage());

    }

    return ""  ;

}

}

The result is the page is unlocked - notice the lock props are gone: