Principal Based ACL for System User?

[learn-design-develop]

Hi All,

We, in our project, create system user via init repo with principal based ACL approach and not path based ACL anymore.

create service user content-service-user with forced path system/cq:services/xyz
set principal ACL for content-service-user
  allow jcr:read on /apps,/content
end

However, previously, to that system user, we had ACL defined via AC tool for some dynamic paths.

- user_config:

    - content-service-user:
        - isSystemUser: true
          path: /home/users/system/cq:services/xyz
          unmanagedAcePathsRegex: "^/apps$|^/content$"

- ace_config:

    - content-service-user:

        - path: /content
          permission: allow
          privileges: jcr:versionManagement,jcr:read,jcr:addChildNodes
          repGlob: "/*/*/website/*/campaigns/genai"

        - path: /content
          permission: allow
          privileges: jcr:versionManagement,jcr:modifyProperties,jcr:read,jcr:addChildNodes,jcr:nodeTypeManagement
          repGlob: "/*/*/website/*/campaigns/genai/*"

Since, system user is following principal based approach, it's not able to follow up with ACL set by AC tool because principal based approach ignores path based ACL.

So, I'd like to know if AC tool supports Principal based ACL as well for users(system user)?

[kwin]

Currently ACTool doesn't support principal based ACLs: #369. But for service users repo-init is usually the best approach as those ACLs/Users are setup prior anything else. With ACTool this would happen much later.