Exclude ACLs from being managed by ACtool

[ackoch]

According to the documentation

"All AC entries are removed from the repository which refer to an authorizable (user/group) being mentioned in the YAML configuration file (no matter to which path those entries refer)."

This is a reasonable default... though I have a use case where it could be nice to be able to define exceptions:

In AEM Assets, you can create "Ad-hoc" permissions. I.e. if you create a folder and switch to the tab "Permissions", you can add principals as Owner/Editor/Viewer. Behind the scenes AEM Assets is creating the necessary groups and assigns the principals.

That works well for users and groups. However, next time you apply the YAML file, the group assignments are removed (in accordance to the documentation cited above).

Now, if we could define exceptions, like "do not alter ACLs below path /content/dam/mybrand/projects" we could use "static" ACLs defined in the ACtool and dynamic/ad hoc ACLs using the "Permission" feature.

WDYT? Would anyone else require that? Would it be hard to integrate into ACtool?

[kwin]

This is already possible with https://github.com/Netcentric/accesscontroltool/blob/develop/docs/AdvancedFeatures.md#configure-unmanaged-aspects (unmanagedAcePathsRegex)

[ackoch]

Thx @kwin . That did the trick. For future reference:

- global_config:
   defaultUnmanagedExternalIsMemberOfRegex: ^mac-default-.*$