Registring Nodetype with Apache Sling / Oak, access error

Question

I try to register custom nodetypes in Sling 11 (oak-tar based):

URL cndURL = new URL("http://localhost:8080/path/to/cnd-file");
boolean result = NodeTypeLoader.registerNodeType(currentNode.getSession(), cndURL);

The CND file gets parsed but registration with Jackrabbit-oak throws an exception:

org.apache.sling.jcr.base.NodeTypeLoader Cannot register node types from http://localhost:8080/content/res/cnd/filing.cnd javax.jcr.AccessDeniedException: Failed to register node types.
        at org.apache.jackrabbit.oak.api.CommitFailedException.asRepositoryException(CommitFailedException.java:231) [org.apache.jackrabbit.oak-api:1.8.8]
        at org.apache.jackrabbit.oak.plugins.nodetype.write.ReadWriteNodeTypeManager.registerNodeTypes(ReadWriteNodeTypeManager.java:156) [org.apache.jackrabbit.oak-core:1.8.8]
        at org.apache.jackrabbit.commons.cnd.CndImporter.registerNodeTypes(CndImporter.java:162) [org.apache.jackrabbit.jackrabbit-jcr-commons:2.16.3]
        at org.apache.sling.jcr.base.NodeTypeLoader.registerNodeType(NodeTypeLoader.java:124) [org.apache.sling.jcr.base:3.0.4] ...   Caused by: org.apache.jackrabbit.oak.api.CommitFailedException: OakAccess0000: Access denied
         at org.apache.jackrabbit.oak.security.authorization.permission.PermissionValidator.checkPermissions(PermissionValidator.java:240) [org.apache.jackrabbit.oak-core:1.8.8] ...
        at org.apache.jackrabbit.oak.core.MutableRoot.commit(MutableRoot.java:261) [org.apache.jackrabbit.oak-core:1.8.8]
        at org.apache.jackrabbit.oak.plugins.nodetype.write.ReadWriteNodeTypeManager.registerNodeTypes(ReadWriteNodeTypeManager.java:145) [org.apache.jackrabbit.oak-core:1.8.8]

Though (sling) user credentials provided are fine, oak as the underlying persistence layer seems to have a problem. What can be done about OakAccess0000?

Answer 1

It remains a secret why the code above resulted in an OakAccess error, as it was executed with Apache Sling's system admin user.

The alternative option to achieve the registration is via Sling's Repository Initialization bundle (docu here). This one worked. The bundle let's you point to a CND file (containing a little bit of additional markup) via its config (as 'raw:file:///local/path/to/file.cnd'). This works nicely and initializes the repo config before the repo itself is started up with the respective resource/node types.