Well i attempted a solution I found that instantiated a subclassed AccessManager. This AccessManager uses a system user to access the repository which would allow full access to any repository node. However, I ran into issues trying to get a reference to my RepositoryImpl inside my AccessManager and I had the same concerns about performance due to the number node lookups being done. My initial strategy was to load an Access Control List(ACL) into the session when a user logged in. Then i could use the AccessManager to check the node uuid against this ACL and allow access if the uuid was in the ACL. However, the AccessManager is run for every type of node including version nodes and nt:resource nodes. Now this would mean that I would have to load every single type of node at login which included version nodes etc... and this could possibly take forever. I really only wanted to restrict access to certain types of nodes and let everything else through. Therefore the only extra piece of information I really needed was the primary node type of the uuid that was passed to the AccessManager. Then I could check the nodeType and restrict access against my ACL if it was a nodeType that needed restriction...unlike the version and resource nodes. After much pain trying to implement an AccessManager that could get the nodeType, i decided to move on and implement a less elegant solution which involved restricting nodes in multiple places instead of in one place like the AcessManager. If anyone has an update or advice on this, I would love to try to implement it again as I think it is the ideal place to put node restriction. I just think the current jackrabbit AccessManager should provide a way to access more specific node information which in my case is the nodeType. I understand that it could be a potential performance issue, but there must be ways to optimize it. Otherwise I can not use the AccessManager to control node specific access. Any ideas or comments?

(Berry) A.W. van Halderen wrote: