Index: config/src/main/resources/domain-cms-acl.xml
===================================================================
--- config/src/main/resources/domain-cms-acl.xml	(revision 34568)
+++ config/src/main/resources/domain-cms-acl.xml	(working copy)
@@ -1,89 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!--
-  Copyright 2007-2009 Hippo
-
-  Licensed under the Apache License, Version 2.0 (the  "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-  http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS"
-  BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
--->
-<sv:node xmlns:sv="http://www.jcp.org/jcr/sv/1.0" xmlns:h="http://www.onehippo.org/jcr/xmlimport" sv:name="cms-acl">
-  <sv:property sv:name="jcr:primaryType" sv:type="Name">
-    <sv:value>hipposys:domain</sv:value>
-  </sv:property>
-  <sv:node sv:name="hippo:authrole">
-    <sv:property sv:name="jcr:primaryType" sv:type="Name">
-      <sv:value>hipposys:authrole</sv:value>
-    </sv:property>
-    <sv:property sv:name="hipposys:groups" sv:type="String" sv:multiple="true">
-      <sv:value>author</sv:value>
-      <sv:value>editor</sv:value>
-    </sv:property>
-    <sv:property sv:name="hipposys:role" sv:type="String">
-      <sv:value>readonly</sv:value>
-    </sv:property>
-  </sv:node>
-  <sv:node sv:name="admin-authrole">
-    <sv:property sv:name="jcr:primaryType" sv:type="Name">
-      <sv:value>hipposys:authrole</sv:value>
-    </sv:property>
-    <sv:property sv:name="hipposys:groups" sv:type="String" sv:multiple="true">
-      <sv:value>admin</sv:value>
-    </sv:property>
-    <sv:property sv:name="hipposys:role" sv:type="String">
-      <sv:value>admin</sv:value>
-    </sv:property>
-  </sv:node>
-  <sv:node sv:name="cms-frontend-application">
-    <sv:property sv:name="jcr:primaryType" sv:type="Name">
-      <sv:value>hipposys:domainrule</sv:value>
-    </sv:property>
-    <sv:node sv:name="match-cms">
-      <sv:property sv:name="jcr:primaryType" sv:type="Name">
-        <sv:value>hipposys:facetrule</sv:value>
-      </sv:property>
-      <sv:property sv:name="hipposys:equals" sv:type="Boolean">
-        <sv:value>true</sv:value>
-      </sv:property>
-      <sv:property sv:name="hipposys:facet" sv:type="String">
-        <sv:value>nodename</sv:value>
-      </sv:property>
-      <sv:property sv:name="hipposys:filter" sv:type="Boolean">
-        <sv:value>false</sv:value>
-      </sv:property>
-      <sv:property sv:name="hipposys:type" sv:type="String">
-        <sv:value>Name</sv:value>
-      </sv:property>
-      <sv:property sv:name="hipposys:value" sv:type="String">
-        <sv:value>cms</sv:value>
-      </sv:property>
-    </sv:node>
-    <sv:node sv:name="type-frontend-application">
-      <sv:property sv:name="jcr:primaryType" sv:type="Name">
-        <sv:value>hipposys:facetrule</sv:value>
-      </sv:property>
-      <sv:property sv:name="hipposys:equals" sv:type="Boolean">
-        <sv:value>true</sv:value>
-      </sv:property>
-      <sv:property sv:name="hipposys:facet" sv:type="String">
-        <sv:value>jcr:primaryType</sv:value>
-      </sv:property>
-      <sv:property sv:name="hipposys:filter" sv:type="Boolean">
-        <sv:value>false</sv:value>
-      </sv:property>
-      <sv:property sv:name="hipposys:type" sv:type="String">
-        <sv:value>Name</sv:value>
-      </sv:property>
-      <sv:property sv:name="hipposys:value" sv:type="String">
-        <sv:value>frontend:application</sv:value>
-      </sv:property>
-    </sv:node>
-  </sv:node>
-</sv:node>
Index: config/src/main/resources/domain-everywhere-exclude-frontend-application.xml
===================================================================
--- config/src/main/resources/domain-everywhere-exclude-frontend-application.xml	(revision 34568)
+++ config/src/main/resources/domain-everywhere-exclude-frontend-application.xml	(working copy)
@@ -1,21 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<sv:node xmlns:sv="http://www.jcp.org/jcr/sv/1.0" sv:name="exclude-frontend-application">
-  <sv:property sv:name="jcr:primaryType" sv:type="Name">
-    <sv:value>hipposys:facetrule</sv:value>
-  </sv:property>
-  <sv:property sv:name="hipposys:equals" sv:type="Boolean">
-    <sv:value>false</sv:value>
-  </sv:property>
-  <sv:property sv:name="hipposys:facet" sv:type="String">
-    <sv:value>jcr:primaryType</sv:value>
-  </sv:property>
-  <sv:property sv:name="hipposys:filter" sv:type="Boolean">
-    <sv:value>false</sv:value>
-  </sv:property>
-  <sv:property sv:name="hipposys:type" sv:type="String">
-    <sv:value>Name</sv:value>
-  </sv:property>
-  <sv:property sv:name="hipposys:value" sv:type="String">
-    <sv:value>frontend:application</sv:value>
-  </sv:property>
-</sv:node>
Index: config/src/main/resources/domain-console-acl.xml
===================================================================
--- config/src/main/resources/domain-console-acl.xml	(revision 34568)
+++ config/src/main/resources/domain-console-acl.xml	(working copy)
@@ -1,87 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!--
-  Copyright 2007-2009 Hippo
-
-  Licensed under the Apache License, Version 2.0 (the  "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-  http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS"
-  BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
--->
-<sv:node xmlns:sv="http://www.jcp.org/jcr/sv/1.0" xmlns:h="http://www.onehippo.org/jcr/xmlimport" sv:name="console-acl">
-  <sv:property sv:name="jcr:primaryType" sv:type="Name">
-    <sv:value>hipposys:domain</sv:value>
-  </sv:property>
-  <sv:node sv:name="hippo:authrole">
-    <sv:property sv:name="jcr:primaryType" sv:type="Name">
-      <sv:value>hipposys:authrole</sv:value>
-    </sv:property>
-    <sv:property sv:name="hipposys:groups" sv:type="String" sv:multiple="true">
-    </sv:property>
-    <sv:property sv:name="hipposys:role" sv:type="String">
-      <sv:value>readonly</sv:value>
-    </sv:property>
-  </sv:node>
-  <sv:node sv:name="admin-authrole">
-    <sv:property sv:name="jcr:primaryType" sv:type="Name">
-      <sv:value>hipposys:authrole</sv:value>
-    </sv:property>
-    <sv:property sv:name="hipposys:groups" sv:type="String" sv:multiple="true">
-      <sv:value>admin</sv:value>
-    </sv:property>
-    <sv:property sv:name="hipposys:role" sv:type="String">
-      <sv:value>admin</sv:value>
-    </sv:property>
-  </sv:node>
-  <sv:node sv:name="console-frontend-application">
-    <sv:property sv:name="jcr:primaryType" sv:type="Name">
-      <sv:value>hipposys:domainrule</sv:value>
-    </sv:property>
-    <sv:node sv:name="match-console">
-      <sv:property sv:name="jcr:primaryType" sv:type="Name">
-        <sv:value>hipposys:facetrule</sv:value>
-      </sv:property>
-      <sv:property sv:name="hipposys:equals" sv:type="Boolean">
-        <sv:value>true</sv:value>
-      </sv:property>
-      <sv:property sv:name="hipposys:facet" sv:type="String">
-        <sv:value>nodename</sv:value>
-      </sv:property>
-      <sv:property sv:name="hipposys:filter" sv:type="Boolean">
-        <sv:value>false</sv:value>
-      </sv:property>
-      <sv:property sv:name="hipposys:type" sv:type="String">
-        <sv:value>Name</sv:value>
-      </sv:property>
-      <sv:property sv:name="hipposys:value" sv:type="String">
-        <sv:value>console</sv:value>
-      </sv:property>
-    </sv:node>
-    <sv:node sv:name="type-frontend-application">
-      <sv:property sv:name="jcr:primaryType" sv:type="Name">
-        <sv:value>hipposys:facetrule</sv:value>
-      </sv:property>
-      <sv:property sv:name="hipposys:equals" sv:type="Boolean">
-        <sv:value>true</sv:value>
-      </sv:property>
-      <sv:property sv:name="hipposys:facet" sv:type="String">
-        <sv:value>jcr:primaryType</sv:value>
-      </sv:property>
-      <sv:property sv:name="hipposys:filter" sv:type="Boolean">
-        <sv:value>false</sv:value>
-      </sv:property>
-      <sv:property sv:name="hipposys:type" sv:type="String">
-        <sv:value>Name</sv:value>
-      </sv:property>
-      <sv:property sv:name="hipposys:value" sv:type="String">
-        <sv:value>frontend:application</sv:value>
-      </sv:property>
-    </sv:node>
-  </sv:node>
-</sv:node>
Index: config/src/main/resources/domain-frontendconfig.xml
===================================================================
--- config/src/main/resources/domain-frontendconfig.xml	(revision 34568)
+++ config/src/main/resources/domain-frontendconfig.xml	(working copy)
@@ -202,46 +202,6 @@
         <sv:value>frontend:application</sv:value>
       </sv:property>
     </sv:node>
-    <sv:node sv:name="exclude-cms">
-        <sv:property sv:name="jcr:primaryType" sv:type="Name">
-            <sv:value>hipposys:facetrule</sv:value>
-        </sv:property>
-        <sv:property sv:name="hipposys:equals" sv:type="Boolean">
-            <sv:value>false</sv:value>
-        </sv:property>
-        <sv:property sv:name="hipposys:facet" sv:type="String">
-            <sv:value>nodename</sv:value>
-        </sv:property>
-        <sv:property sv:name="hipposys:filter" sv:type="Boolean">
-            <sv:value>false</sv:value>
-        </sv:property>
-        <sv:property sv:name="hipposys:type" sv:type="String">
-            <sv:value>Name</sv:value>
-        </sv:property>
-        <sv:property sv:name="hipposys:value" sv:type="String">
-            <sv:value>cms</sv:value>
-        </sv:property>
-    </sv:node>
-    <sv:node sv:name="exclude-console">
-        <sv:property sv:name="jcr:primaryType" sv:type="Name">
-            <sv:value>hipposys:facetrule</sv:value>
-        </sv:property>
-        <sv:property sv:name="hipposys:equals" sv:type="Boolean">
-            <sv:value>false</sv:value>
-        </sv:property>
-        <sv:property sv:name="hipposys:facet" sv:type="String">
-            <sv:value>nodename</sv:value>
-        </sv:property>
-        <sv:property sv:name="hipposys:filter" sv:type="Boolean">
-            <sv:value>false</sv:value>
-        </sv:property>
-        <sv:property sv:name="hipposys:type" sv:type="String">
-            <sv:value>Name</sv:value>
-        </sv:property>
-        <sv:property sv:name="hipposys:value" sv:type="String">
-            <sv:value>console</sv:value>
-        </sv:property>
-    </sv:node>
   </sv:node>
   <sv:node sv:name="hippo:authrole">
     <sv:property sv:name="jcr:primaryType" sv:type="Name">
Index: config/src/main/resources/hippoecm-extension.xml
===================================================================
--- config/src/main/resources/hippoecm-extension.xml	(revision 34568)
+++ config/src/main/resources/hippoecm-extension.xml	(working copy)
@@ -63,48 +63,6 @@
       <sv:value>914.0</sv:value>
     </sv:property>
   </sv:node>
-  <sv:node sv:name="domain-everywhere-exclude-frontend-application">
-    <sv:property sv:name="jcr:primaryType" sv:type="Name">
-      <sv:value>hippo:initializeitem</sv:value>
-    </sv:property>
-    <sv:property sv:name="hippo:contentresource" sv:type="String">
-      <sv:value>domain-everywhere-exclude-frontend-application.xml</sv:value>
-    </sv:property>
-    <sv:property sv:name="hippo:contentroot" sv:type="String">
-      <sv:value>/hippo:configuration/hippo:domains/everywhere/all-nodes</sv:value>
-    </sv:property>
-    <sv:property sv:name="hippo:sequence" sv:type="Double">
-      <sv:value>915.0</sv:value>
-    </sv:property>
-  </sv:node>
-  <sv:node sv:name="domain-cms-acl">
-    <sv:property sv:name="jcr:primaryType" sv:type="Name">
-      <sv:value>hippo:initializeitem</sv:value>
-    </sv:property>
-    <sv:property sv:name="hippo:contentresource" sv:type="String">
-      <sv:value>domain-cms-acl.xml</sv:value>
-    </sv:property>
-    <sv:property sv:name="hippo:contentroot" sv:type="String">
-      <sv:value>/hippo:configuration/hippo:domains</sv:value>
-    </sv:property>
-    <sv:property sv:name="hippo:sequence" sv:type="Double">
-      <sv:value>917.0</sv:value>
-    </sv:property>
-  </sv:node>
-  <sv:node sv:name="domain-console-acl">
-    <sv:property sv:name="jcr:primaryType" sv:type="Name">
-      <sv:value>hippo:initializeitem</sv:value>
-    </sv:property>
-    <sv:property sv:name="hippo:contentresource" sv:type="String">
-      <sv:value>domain-console-acl.xml</sv:value>
-    </sv:property>
-    <sv:property sv:name="hippo:contentroot" sv:type="String">
-      <sv:value>/hippo:configuration/hippo:domains</sv:value>
-    </sv:property>
-    <sv:property sv:name="hippo:sequence" sv:type="Double">
-      <sv:value>919.0</sv:value>
-    </sv:property>
-  </sv:node>
   <sv:node sv:name="domain-hippogallery">
     <sv:property sv:name="jcr:primaryType" sv:type="Name">
       <sv:value>hippo:initializeitem</sv:value>
Index: engine/src/main/java/org/hippoecm/frontend/plugins/login/LoginPlugin.java
===================================================================
--- engine/src/main/java/org/hippoecm/frontend/plugins/login/LoginPlugin.java	(revision 34568)
+++ engine/src/main/java/org/hippoecm/frontend/plugins/login/LoginPlugin.java	(working copy)
@@ -238,7 +238,7 @@
             } catch (LoginException le) {
                 log.debug(ERROR_MESSAGE_LOGIN_FAILURE, le);
                 success = false;
-                loginExceptionPageParameters = buildPageParameters(le);
+                loginExceptionPageParameters = buildPageParameters(le.getLoginExceptionCause());
             }
 
             ConcurrentLoginFilter.validateSession(session, username, false);
@@ -246,13 +246,6 @@
             redirect(success, loginExceptionPageParameters);
         }
 
-        protected PageParameters buildPageParameters(LoginException le) {
-            Map<String, String> pageParameters = new HashMap<String, String>(1);
-            
-            pageParameters.put(PAGE_PARAMS_KEY_LOGIN_EXCEPTION_CAUSE, le.getLoginExceptionCause().name());
-            return new PageParameters(pageParameters);
-        }
-
         protected void redirect(boolean success, PageParameters pageParameters) {
             if (success == false) {
                 Main main = (Main) Application.get();
@@ -286,6 +279,13 @@
             redirect(success, null);
         }
 
+        protected PageParameters buildPageParameters(LoginException.CAUSE cause) {
+            Map<String, String> pageParameters = new HashMap<String, String>(1);
+            
+            pageParameters.put(PAGE_PARAMS_KEY_LOGIN_EXCEPTION_CAUSE, cause.name());
+            return new PageParameters(pageParameters);
+        }
+
     }
 
 }
Index: engine/src/main/java/org/hippoecm/frontend/plugins/login/RememberMeLoginPlugin.java
===================================================================
--- engine/src/main/java/org/hippoecm/frontend/plugins/login/RememberMeLoginPlugin.java	(revision 34568)
+++ engine/src/main/java/org/hippoecm/frontend/plugins/login/RememberMeLoginPlugin.java	(working copy)
@@ -15,6 +15,7 @@
  */
 package org.hippoecm.frontend.plugins.login;
 
+import java.security.AccessControlException;
 import java.security.MessageDigest;
 import java.security.NoSuchAlgorithmException;
 import java.util.HashMap;
@@ -56,6 +57,7 @@
 import org.hippoecm.frontend.model.UserCredentials;
 import org.hippoecm.frontend.plugin.IPluginContext;
 import org.hippoecm.frontend.plugin.config.IPluginConfig;
+import org.hippoecm.frontend.security.acl.AclManager;
 import org.hippoecm.frontend.session.PluginUserSession;
 import org.hippoecm.frontend.util.WebApplicationHelper;
 import org.hippoecm.repository.api.HippoNodeType;
@@ -71,7 +73,7 @@
     private final static String SVN_ID = "$Id: $";
 
     private final static String DEFAULT_KEY = "invalid.login";
-    private final static Map<String, String> causeKeys;    
+    private final static Map<String, String> causeKeys;
     static {
         causeKeys = new HashMap<String, String>(3);
         causeKeys.put(org.hippoecm.frontend.session.LoginException.CAUSE.INCORRECT_CREDENTIALS.name(), "invalid.login");
@@ -79,10 +81,12 @@
         causeKeys.put(org.hippoecm.frontend.session.LoginException.CAUSE.ACCESS_DENIED.name(), "access.denied");
         causeKeys.put(org.hippoecm.frontend.session.LoginException.CAUSE.REPOSITORY_ERROR.name(), "repository.error");
     }
-    
+
     private static final int COOKIE_DEFAULT_MAX_AGE = 1209600;
-    private final String REMEMBERME_COOKIE_NAME = WebApplicationHelper.getFullyQualifiedCookieName(WebApplicationHelper.REMEMBERME_COOKIE_BASE_NAME);
-    private final String HIPPO_AUTO_LOGIN_COOKIE_NAME = WebApplicationHelper.getFullyQualifiedCookieName(WebApplicationHelper.HIPPO_AUTO_LOGIN_COOKIE_BASE_NAME);
+    private final String REMEMBERME_COOKIE_NAME = WebApplicationHelper
+            .getFullyQualifiedCookieName(WebApplicationHelper.REMEMBERME_COOKIE_BASE_NAME);
+    private final String HIPPO_AUTO_LOGIN_COOKIE_NAME = WebApplicationHelper
+            .getFullyQualifiedCookieName(WebApplicationHelper.HIPPO_AUTO_LOGIN_COOKIE_BASE_NAME);
     private static final String HAL_REQUEST_ATTRIBUTE_NAME = "in_try_hippo_autologin";
     private static final long serialVersionUID = 1L;
 
@@ -110,13 +114,16 @@
             // Check for remember me cookie
             if ((WebApplicationHelper.retrieveWebRequest().getCookie(REMEMBERME_COOKIE_NAME) != null)
                     && (WebApplicationHelper.retrieveWebRequest().getCookie(HIPPO_AUTO_LOGIN_COOKIE_NAME) != null)
-                    && (WebApplicationHelper.retrieveWebRequest().getHttpServletRequest().getAttribute(HAL_REQUEST_ATTRIBUTE_NAME) == null)) {
+                    && (WebApplicationHelper.retrieveWebRequest().getHttpServletRequest()
+                            .getAttribute(HAL_REQUEST_ATTRIBUTE_NAME) == null)) {
 
-                WebApplicationHelper.retrieveWebRequest().getHttpServletRequest().setAttribute(HAL_REQUEST_ATTRIBUTE_NAME, true);
+                WebApplicationHelper.retrieveWebRequest().getHttpServletRequest()
+                        .setAttribute(HAL_REQUEST_ATTRIBUTE_NAME, true);
                 try {
                     tryToAutoLoginWithRememberMe();
                 } finally {
-                    WebApplicationHelper.retrieveWebRequest().getHttpServletRequest().removeAttribute(HAL_REQUEST_ATTRIBUTE_NAME);
+                    WebApplicationHelper.retrieveWebRequest().getHttpServletRequest()
+                            .removeAttribute(HAL_REQUEST_ATTRIBUTE_NAME);
                 }
             }
         }
@@ -144,7 +151,8 @@
 
     @Override
     protected LoginPlugin.SignInForm createSignInForm(String id) {
-        Cookie rememberMeCookie = WebApplicationHelper.retrieveWebRequest().getCookie(WebApplicationHelper.getFullyQualifiedCookieName(WebApplicationHelper.REMEMBERME_COOKIE_BASE_NAME)); 
+        Cookie rememberMeCookie = WebApplicationHelper.retrieveWebRequest().getCookie(
+                WebApplicationHelper.getFullyQualifiedCookieName(WebApplicationHelper.REMEMBERME_COOKIE_BASE_NAME));
         boolean rememberme = (rememberMeCookie != null) ? Boolean.valueOf(rememberMeCookie.getValue()) : false;
 
         if (rememberme) {
@@ -159,7 +167,7 @@
         }
 
         LoginPlugin.SignInForm form = new SignInForm(id, rememberme);
-        
+
         return form;
     }
 
@@ -222,7 +230,8 @@
                         WebApplicationHelper.clearCookie(HIPPO_AUTO_LOGIN_COOKIE_NAME);
                     } else {
                         Cookie remembermeCookie = new Cookie(REMEMBERME_COOKIE_NAME, String.valueOf(true));
-                        remembermeCookie.setMaxAge(RememberMeLoginPlugin.this.getPluginConfig().getAsInteger("rememberme.cookie.maxage", COOKIE_DEFAULT_MAX_AGE));
+                        remembermeCookie.setMaxAge(RememberMeLoginPlugin.this.getPluginConfig().getAsInteger(
+                                "rememberme.cookie.maxage", COOKIE_DEFAULT_MAX_AGE));
                         WebApplicationHelper.retrieveWebResponse().addCookie(remembermeCookie);
                     }
 
@@ -237,7 +246,7 @@
                     WebApplicationHelper.clearCookie(HIPPO_AUTO_LOGIN_COOKIE_NAME);
                 }
             });
-            
+
             passwordTextField.add(new AjaxFormComponentUpdatingBehavior("onchange") {
                 private static final long serialVersionUID = 1L;
 
@@ -254,9 +263,8 @@
             AjaxButton ajaxButton = new AjaxButton("submit", new ResourceModel("submit-label")) {
 
                 @Override
-                protected void onError(AjaxRequestTarget target, Form<?> form)
-                {
-                    target.addComponent(feedback);                   
+                protected void onError(AjaxRequestTarget target, Form<?> form) {
+                    target.addComponent(feedback);
                 }
 
                 @Override
@@ -308,17 +316,36 @@
                 }
 
                 userSession.login(new UserCredentials(new SimpleCredentials(username, password.toCharArray())));
+                AclManager.checkAccess(getPluginConfig(), userSession.getJcrSession());
             } catch (org.hippoecm.frontend.session.LoginException le) {
                 success = false;
-                loginExceptionPageParameters = buildPageParameters(le);
+                loginExceptionPageParameters = buildPageParameters(le.getLoginExceptionCause());
+            } catch (AccessControlException ace) {
+                success = false;
+                // Invalidate the current obtained JCR session and create an anonymous one
+                userSession.login();
+                loginExceptionPageParameters = buildPageParameters(org.hippoecm.frontend.session.LoginException.CAUSE.ACCESS_DENIED);
+            } catch (RepositoryException re) {
+                success = false;
+                // Invalidate the current obtained JCR session and create an anonymous one
+                userSession.login();
+                if (log.isDebugEnabled()) {
+                    log.warn("Repository error while trying to access the "
+                            + WebApplicationHelper.getApplicationName("cms") + " application with user '" + username
+                            + "'", re);
+                }
+
+                loginExceptionPageParameters = buildPageParameters(org.hippoecm.frontend.session.LoginException.CAUSE.REPOSITORY_ERROR);
             }
 
             if (success) {
-                ConcurrentLoginFilter.validateSession(((WebRequest) SignInForm.this.getRequest()).getHttpServletRequest().getSession(true),
-                        username, false);
+                ConcurrentLoginFilter.validateSession(((WebRequest) SignInForm.this.getRequest())
+                        .getHttpServletRequest().getSession(true), username, false);
 
                 // If rememberme checkbox is checked and there is no cookie already, this happens in case of autologin
-                if (rememberme && WebApplicationHelper.retrieveWebRequest().getCookie(HIPPO_AUTO_LOGIN_COOKIE_NAME) == null) {
+                if (rememberme
+                        && WebApplicationHelper.retrieveWebRequest().getCookie(HIPPO_AUTO_LOGIN_COOKIE_NAME) == null) {
+
                     Session jcrSession = userSession.getJcrSession();
                     if (jcrSession.getUserID().equals(username)) {
                         try {
@@ -330,8 +357,10 @@
                                     + Base64.encodeBase64URLSafeString(digest.digest());
 
                             final Cookie halCookie = new Cookie(HIPPO_AUTO_LOGIN_COOKIE_NAME, passphrase);
-                            halCookie.setMaxAge(RememberMeLoginPlugin.this.getPluginConfig().getAsInteger("hal.cookie.maxage", COOKIE_DEFAULT_MAX_AGE));
-                            halCookie.setSecure(RememberMeLoginPlugin.this.getPluginConfig().getAsBoolean("use.secure.cookies", false));
+                            halCookie.setMaxAge(RememberMeLoginPlugin.this.getPluginConfig().getAsInteger(
+                                    "hal.cookie.maxage", COOKIE_DEFAULT_MAX_AGE));
+                            halCookie.setSecure(RememberMeLoginPlugin.this.getPluginConfig().getAsBoolean(
+                                    "use.secure.cookies", false));
 
                             // Replace with Cookie#setHttpOnly when we upgrade to a container compliant with
                             // Servlet API(s) v3.0t his was added cause the setHttpOnly/isHttpOnly at the time of
@@ -342,7 +371,8 @@
                                     RememberMeLoginPlugin.this.getPluginConfig().getAsBoolean("use.httponly.cookies",
                                             false));
 
-                            Node userinfo = jcrSession.getRootNode().getNode(HippoNodeType.CONFIGURATION_PATH + "/" + HippoNodeType.USERS_PATH + "/" + username);
+                            Node userinfo = jcrSession.getRootNode().getNode(
+                                    HippoNodeType.CONFIGURATION_PATH + "/" + HippoNodeType.USERS_PATH + "/" + username);
                             String[] strings = passphrase.split("\\$");
                             userinfo.setProperty(HippoNodeType.HIPPO_PASSKEY, strings[0] + "$" + strings[2]);
                             userinfo.save();
@@ -359,24 +389,23 @@
                 HippoEventBus eventBus = HippoServiceRegistry.getService(HippoEventBus.class);
                 if (eventBus != null) {
                     HippoEvent event = new HippoEvent(userSession.getApplicationName())
-                            .user(userSession.getJcrSession().getUserID())
-                            .action("login")
-                            .category(HippoSecurityEventConstants.CATEGORY_SECURITY)
-                            .message(username + " logged in");
+                            .user(userSession.getJcrSession().getUserID()).action("login")
+                            .category(HippoSecurityEventConstants.CATEGORY_SECURITY).message(username + " logged in");
                     eventBus.post(event);
                 }
-            } else {                
+            } else {
                 String key = DEFAULT_KEY;
                 if (loginExceptionPageParameters != null) {
-                    Object loginExceptionCause = loginExceptionPageParameters.get(org.hippoecm.frontend.session.LoginException.CAUSE.class.getName());
+                    Object loginExceptionCause = loginExceptionPageParameters
+                            .get(org.hippoecm.frontend.session.LoginException.CAUSE.class.getName());
 
                     if ((loginExceptionCause != null) && (loginExceptionCause instanceof String)) {
                         key = causeKeys.get(loginExceptionCause);
                         key = StringUtils.isNotBlank(key) ? key : DEFAULT_KEY;
                     }
 
-                    info(new StringResourceModel(key, this, null).getString());                    
-                }                
+                    info(new StringResourceModel(key, this, null).getString());
+                }
 
                 // Clear the Hippo Auto Login cookie
                 WebApplicationHelper.clearCookie(HIPPO_AUTO_LOGIN_COOKIE_NAME);
@@ -386,10 +415,8 @@
                 HippoEventBus eventBus = HippoServiceRegistry.getService(HippoEventBus.class);
                 if (eventBus != null) {
                     HippoEvent event = new HippoEvent(userSession.getApplicationName())
-                            .user(userSession.getJcrSession().getUserID())
-                            .action("login")
-                            .category(HippoSecurityEventConstants.CATEGORY_SECURITY)
-                            .result("failure")
+                            .user(userSession.getJcrSession().getUserID()).action("login")
+                            .category(HippoSecurityEventConstants.CATEGORY_SECURITY).result("failure")
                             .message(username + " failed to login");
                     eventBus.post(event);
                 }
@@ -427,7 +454,8 @@
             captchaLabel = new Label("captchaLabel", new ResourceModel("captcha-label", "Enter the letters above"));
             // Clear the value of the captcha text field
             captchaTextValue = "";
-            captchaTextField = new RequiredTextField<String>("captcha", new PropertyModel<String>(SignInForm.this, "captchaTextValue"));
+            captchaTextField = new RequiredTextField<String>("captcha", new PropertyModel<String>(SignInForm.this,
+                    "captchaTextValue"));
             captchaImage = new Image("captchaImage", captchaImageResource) {
 
                 private static final long serialVersionUID = 1L;
Index: api/src/main/java/org/hippoecm/frontend/security/acl/AclManager.java
===================================================================
--- api/src/main/java/org/hippoecm/frontend/security/acl/AclManager.java	(revision 0)
+++ api/src/main/java/org/hippoecm/frontend/security/acl/AclManager.java	(revision 0)
@@ -0,0 +1,73 @@
+/*
+ *  Copyright 2012 Hippo.
+ * 
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ * 
+ *       http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ */
+package org.hippoecm.frontend.security.acl;
+
+import java.security.AccessControlException;
+
+import javax.jcr.RepositoryException;
+import javax.jcr.Session;
+
+import org.apache.commons.lang.StringUtils;
+import org.hippoecm.frontend.plugin.config.IPluginConfig;
+import org.hippoecm.frontend.util.WebApplicationHelper;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * A utility class for managing access control rights to different frontend applications
+ * namely CMS and Console  
+ */
+public class AclManager {
+
+    private static final Logger log = LoggerFactory.getLogger(AclManager.class);
+    private static final String PRIVELEGES_CONFIGURATION_PARAM_POSTFIX = ".priveleges";
+    private static final String PRIVELEGES_PATH_CONFIGURATION_PARAM_POSTFIX = ".priveleges.path";
+
+    /**
+     * Check whether a certain user which obtained a JCR session has access to a certain frontend application or not 
+     * 
+     * @param config - A plugin configuration from which some configuration parameters will be retrieved
+     * @param session - A JCR session to check access with
+     * @throws RepositoryException If any repository error happened
+     * @throws AccessControlException If permission is denied
+     */
+    public static void checkAccess(IPluginConfig config, Session session) throws AccessControlException,
+            RepositoryException {
+
+        // Validate parameters
+        if (config == null) {
+            throw new IllegalArgumentException("A null configuration parameter has been passed");
+        }
+
+        if (session == null) {
+            throw new IllegalArgumentException("A null session parameter has been passed");
+        }
+
+        // Do the magic here
+        final String applicationName = WebApplicationHelper.getApplicationName("cms");
+        final String priveleges = config.getString(applicationName + PRIVELEGES_CONFIGURATION_PARAM_POSTFIX);
+        final String privelegesPath = config.getString(applicationName + PRIVELEGES_PATH_CONFIGURATION_PARAM_POSTFIX);
+
+        if (StringUtils.isBlank(priveleges) || StringUtils.isBlank(privelegesPath)) {
+            log.info("No privelegs found for application " + applicationName);
+            log.debug("Application " + applicationName + " had priveleges: " + priveleges + ", and path: "
+                    + privelegesPath);
+        } else {
+            session.checkPermission(privelegesPath, priveleges);
+        }
+    }
+
+}

Property changes on: api/src/main/java/org/hippoecm/frontend/security/acl/AclManager.java
___________________________________________________________________
Added: svn:keywords
   + Id
Added: svn:eol-style
   + native

Index: api/src/main/java/org/hippoecm/frontend/util/WebApplicationHelper.java
===================================================================
--- api/src/main/java/org/hippoecm/frontend/util/WebApplicationHelper.java	(revision 34568)
+++ api/src/main/java/org/hippoecm/frontend/util/WebApplicationHelper.java	(working copy)
@@ -83,6 +83,10 @@
 
         return result;
     }
+    
+    public static String getApplicationName(final String defaultName) {
+        return getConfigurationParameter(PLUGIN_APPLICATION_NAME_PARAMETER, defaultName);
+    }
 
     protected static void validateNotBlank(String value) {
         if (value == null || "".equals(value)) {
