All I want to do is hack around with roles set on a node basis to see how search relates to this in case of visibility and access, so I just need two sample roles to figure out if my hierachy is gonna work the way I want it to, e.g.:

       users admin and john doe - expected result: they can't see nodes/documents created by other users - See more at: https://developer.jboss.org/message/934662?et=watches.email.thread#934662

By default, when searching, ModeShape will only check generic READ access on the nodes, based whatever authorization & authentication mechanism you have set up. There is no way around this, so if you're not using a container which already has JAAS enabled for example, you need to set a JAAS provider up - in our unit tests we use Pickebox for JAAS.

If your use case is more complicated - i.e. both users have READ permissions but each should see a subset of nodes based on some context-dependent criteria, the only option is to implement your own authorization provider and configure ModeShape to use it. See Custom authentication providers - ModeShape 4 - Project Documentation Editor for more information. This means that you don't necessarily need to use one of the existing security providers (JAAS or Servlet) but then you need to implement the entire authentication & authorization logic in your own code.

Configuration wise, you should only implement & configure in JSON an AuthenticationProvider (and not an AuthorizationProvider). To hook up the AuthorizationProvider part, you need to use the security context. Have a look at modeshape/AuthenticationAndAuthorizationTest.java at master · ModeShape/modeshape · GitHub and modeshape/AuthenticationAndAuthorizationTest.java at master · ModeShape/modeshape · GitHub to better understand how this works. In essence, the authentication provider will set up a custom security context implementation which is also an AuthenticationProvider.

Could you please comment my idea of a hierachy/permission system, I could not find any examples of it: I wan't to structure a document system like a unix file system, i.e. every user has a "home" directory at the root of all documents - I think this way search operations would be faster since only the child nodes of the user would be affected, is this correct?

Search performance in ModeShape is more a function of the search criteria (plus index definitions in ModeShape 4 - i.e. limiting the amount of information that's indexed) and not so much a function of the underlying permissions scheme. In other words, the more specific (restrictive) a search criteria, the better since fewer nodes will need to be looked at. For example, searching only the children of a node under a given path is almost always faster than searching all the nodes under "/" (root) or performing multiple joins. Permission checking only comes into play after a set of nodes matching the search criteria have been found. From this perspective, this is identical to the case when you're retrieving a node by path: the exact same security checks will be performed in both cases. First ModeShape will retrieve the node from the repository and then it will ask the authorization provider(s) and/or access control managers (via ACLs) if that node can be read.

To share documents, I would put weak references in the home directory of the user I share it to. However, admin users need to see everything, so I am not sure how to put that into a data structure:

You can use weak node references but you can also use simple string properties (like node paths or identifiers) which may perform better depending on the case. You can also use more search criteria on String properties than on Reference properties.

Is this a good idea? Are there any examples or other literature about jcr data structures concerning permission and read/search performance?

I'm not aware of any blueprints anywhere, since JCR is a relatively vast spec that can be used and/or abused in any number of different ways, all of which are very much context dependent to a given problem. The best source of information is probably other people's usage patterns and experience.

Regarding fine grained permissions in ModeShape you have 2 options:

1. implement your custom security provider (as discussed above)
2. use JCR ACLs - JCR 2.0: 16 Access Control Management (Content Repository for Java Technology API v2.0).

Performance wise, both are expensive in general since it essentially means that *any* node related operations (reading/writing/searching/etc) will always go through some additional security layers. It's hard to say if one approach is better than the other, since it very much depends on the custom security provider implementation (i.e. a good/fast provider implementation may outperform ACLs). In the hierarchy structure that you mentioned both approaches would work. You can execute a search on an active session trying to find all the nodes which are under "/home/user" and then either 1. perform the permission logic in your own code or 2. rely on the previously set ACLs, in which case you don't need any additional code.

That exception is thrown because this condition: modeshape/AccessControlManagerImpl.java at master · ModeShape/modeshape · GitHub fails (in turn this is checked here: https://github.com/ModeShape/modeshape/blob/master/modeshape-jcr/src/main/java/org/modeshape/jcr/security/acl/JcrAccessControlList.java#L132)

Are you using both ACLs and your own custom provider at the same time ? If yes, you should debug the code and investigate why "hasPrivileges" is failing. In general however, you shouldn't need to use both at the same time. Is most cases you should use one or the other.