Content Selectors, Repository Targets, Fine-Grained Privileges, and Path-Level Authorization: Concepts, Architecture, and Mental Model

1. The practical problem: repository access is usually too coarse

A single hosted repository may contain artifacts for dozens of teams. A repository-wide role such as “read everything in internal-raw” is simple, but it cannot express “Team A may publish only below /team-a/, Team B only below /team-b/, and neither may delete.” Creating a repository per team can solve isolation but increases repository, backup, cleanup, routing, and client-configuration sprawl.

Content selectors provide the middle layer. A selector describes a subset of content, normally by repository path. A custom Repository Content Selector privilege binds that selector to a repository and a set of actions. Roles aggregate those privileges, and users inherit their roles.

2. The policy chain

flowchart TD
A[Asset path] --> S[CSEL selector]
S --> P[Content-selector privilege]
P --> R[Role]
R --> U[User / service account]
W[Repository-wide privilege] --> R
G[Inherited role] --> R
U --> Q{Effective request authorization}
Q -->|Granted somewhere| Y[Allow]
Q -->|No matching grant| N[Deny]

The critical arrow is the last one. Nexus privileges are additive grants. A narrow selector does not subtract access granted by another repository-wide privilege, another selector, another role, an inherited role, or a default role. Therefore “I assigned a narrow role” is not proof that the user is narrow.

3. Define the objects before editing them

4. CSEL: prefer explicit prefix matching

Current content-selector expressions use Content Selector Expression Language (CSEL). The asset path begins with a leading slash. For a Raw namespace, a simple selector is:

format == "raw" and path =^ "/team-a/"

The =^ operator means “starts with.” Sonatype recommends it over an equivalent regular expression when possible because it is substantially cheaper to evaluate and behaves more predictably in PostgreSQL/HA search paths. A regex such as path =~ "^/team-a/.*" can work, but adds complexity without value here.

Do not build new policy around coordinate-based selectors. Current database guidance deprecates coordinate-based content selectors with PostgreSQL and states they are no longer supported there. Path is the portable baseline; enhanced format attributes exist for selected formats such as Maven, NuGet, Terraform, and Swift.

5. Browse, read, add, edit, and delete are separate capabilities

Search UI behavior is separate again: current Nexus uses nx-search-read plus repository browse access for search visibility. A user can therefore have a direct content read permission without receiving the same discovery experience as an administrator.

6. Group access is a separate authorization surface

A group endpoint aggregates content from its members. Sonatype explicitly documents that privileges on a group provide access to member content through the group even when the user lacks direct privileges on those members. Conversely, a group privilege does not grant direct member access.

7. “Repository target” is legacy terminology

Nexus Repository 2 used repository targets based on regular expressions. During migration to Nexus Repository 3, those targets are converted to content selectors expressed in CSEL. When an old runbook says “repository target,” translate the intent into a current selector + privilege + role model instead of looking for an equivalent modern screen named Repository Target.

8. Read-only inspection before policy changes

export NX_URL="http://127.0.0.1:8081"
export LAB="${TMPDIR:-/tmp}/nexus-ch14-readonly"
mkdir -p "$LAB/evidence"

curl -fsS "$NX_URL/service/rest/v1/status"   -o "$LAB/evidence/status.txt"
# Authenticate through a private netrc file for administrative reads.
read -r -p 'Disposable Nexus admin user: ' NX_USER
read -r -s -p 'Disposable Nexus admin password: ' NX_PASS; echo
export NX_AUTH_FILE="$(mktemp)"
chmod 600 "$NX_AUTH_FILE"
printf 'machine 127.0.0.1 login %s password %s\n' "$NX_USER" "$NX_PASS" > "$NX_AUTH_FILE"
unset NX_PASS

curl -fsS --netrc-file "$NX_AUTH_FILE" "$NX_URL/service/rest/v1/repositories"   > "$LAB/evidence/repositories-before.json"
curl -fsS --netrc-file "$NX_AUTH_FILE" "$NX_URL/service/rest/v1/security/content-selectors"   > "$LAB/evidence/selectors-before.json"
curl -fsS --netrc-file "$NX_AUTH_FILE" "$NX_URL/service/rest/v1/security/roles"   > "$LAB/evidence/roles-before.json"

These requests inspect configuration objects. They do not read or mutate blob files or database tables directly. In the UI, also record the actual Nexus version/edition/runtime and check whether anonymous/default roles grant unexpected repository access before designing a fine-grained policy.

9. Trust boundaries

Content selectors answer authorization: may this principal act on this path? They do not prove that an artifact is trustworthy, signed, vulnerability-free, or produced by the expected build. They also do not replace TLS, upstream routing controls, cleanup policy, backup, or package-manager client configuration. Security reviews should keep those boundaries explicit.

10. Knowledge check

11. Summary and next step

You now have the model needed to reason about path-level authorization: CSEL selects content, privileges grant actions over that selection, roles add grants together, and group endpoints must be authorized explicitly. Lesson 2 turns that model into a disposable two-namespace workflow.

Official references and version notes

• Sonatype: Content Selectors — CSEL syntax, preview, supported formats, performance guidance, and upload limitations.
• Sonatype: Privileges — repository view versus content-selector privileges, actions, additive grants, and group semantics.
• Sonatype: Access Control — RBAC object model.
• Sonatype: Security Management API and API Reference.
• Sonatype: Changes During the Upgrade Process — Nexus Repository 2 repository targets become Nexus Repository 3 content selectors.
• Self-Hosted Feature Matrix — Repo Targets / Content Selectors are Community and Pro capabilities.
• Sonatype: Database Options — coordinate-based selectors are deprecated with PostgreSQL and no longer supported.
• Sonatype verified Nexus Docker image tags.

Version-sensitive statements were rechecked on 2026-08-26. Sonatype's verified container registry exposes Nexus Repository 3.95.2 as the current latest image line. The mandatory chapter path uses Community-compatible content selectors, local users/roles, Raw hosted/group repositories, and the self-hosted security APIs. It does not require Pro user tokens, SAML/OIDC, HA, staging, Repository Firewall, or deployment to a group repository.