Security is enforced around public services. Web services, web scripts, SkyVault Share,
CIFS, WebDAV, FTP, CMIS, and more, all use public services, and therefore include security
enforcement.
Public services are defined in public-services-context.xml.
Access control allows or prevents users or processes acting on behalf of a user, from executing service methods on a particular object by checking if the current user, or any of the authorities granted to the current user, has a particular permission or permission group, or that the user has a particular authority.
For example, on the NodeService bean, the readProperties method checks that the current user has Read permission for the node before invoking the method and returning the node’s properties. On the SearchService query method, the results are restricted to return only the nodes for which a user has Read permission.