As of Oak 1.0 the following interfaces and class that were internal to Jackrabbit have been made part of public API exposed by Oak:
In contrast to Jackrabbit 2.x Oak only deals with a single PrincipalProvider. In order to combine principals from different sources a implementation that properly handles the different sources is required; the CompositePrincipalProvider is an example that combines multiple implementations.
See section Pluggability for an example.