in src/main/java/org/apache/sling/feature/cpconverter/accesscontrol/DefaultAclManager.java [247:276]
private void addUsersAndGroups(@NotNull Formatter formatter) throws ConverterException {
for (SystemUser systemUser : systemUsers) {
// make sure all system users are created first
boolean withForcedPath = (alwaysForceSystemUserPath || enforcePrincipalBased(systemUser));
CreateServiceUser operation = new CreateServiceUser(systemUser.getId(), new WithPathOptions(calculateIntermediatePath(systemUser), withForcedPath));
formatter.format("%s", operation.asRepoInitString());
if (systemUser.getDisabledReason() != null) {
DisableServiceUser disable = new DisableServiceUser(systemUser.getId(), systemUser.getDisabledReason());
disable.setServiceUser(true);
formatter.format("%s", disable.asRepoInitString());
}
if (aclIsBelow(systemUser.getPath())) {
throw new ConverterException("Detected policy on subpath of system-user: " + systemUser);
}
}
// abort the conversion if an access control entry takes effect at or below a user/group which is not
// created by repo-init statements generated here.
for(final Group g : groups) {
if (aclStartsWith(g.getPath())) {
throw new ConverterException("Detected policy on group: " + g);
}
}
for(final User u : users) {
if (aclStartsWith(u.getPath())) {
throw new ConverterException("Detected policy on user: " + u);
}
}
}