diff --git a/src/main/java/org/apache/sling/jcr/jackrabbit/accessmanager/post/AbstractAccessGetServlet.java b/src/main/java/org/apache/sling/jcr/jackrabbit/accessmanager/post/AbstractAccessGetServlet.java
index 6adc061..dc2bcda 100644
--- a/src/main/java/org/apache/sling/jcr/jackrabbit/accessmanager/post/AbstractAccessGetServlet.java
+++ b/src/main/java/org/apache/sling/jcr/jackrabbit/accessmanager/post/AbstractAccessGetServlet.java
@@ -50,11 +50,9 @@
 import org.apache.jackrabbit.api.security.authorization.PrincipalAccessControlList;
 import org.apache.jackrabbit.api.security.principal.PrincipalManager;
 import org.apache.jackrabbit.oak.spi.security.authorization.restriction.RestrictionDefinition;
-import org.apache.jackrabbit.oak.spi.security.authorization.restriction.RestrictionProvider;
 import org.apache.sling.api.SlingHttpServletRequest;
 import org.apache.sling.api.SlingHttpServletResponse;
 import org.apache.sling.api.resource.ResourceNotFoundException;
-import org.apache.sling.api.servlets.SlingAllMethodsServlet;
 import org.apache.sling.jcr.base.util.AccessControlUtil;
 import org.apache.sling.jcr.jackrabbit.accessmanager.LocalPrivilege;
 import org.apache.sling.jcr.jackrabbit.accessmanager.LocalRestriction;
@@ -64,21 +62,7 @@
 import org.jetbrains.annotations.Nullable;
 
 @SuppressWarnings("serial")
-public abstract class AbstractAccessGetServlet extends SlingAllMethodsServlet {
-
-    private transient RestrictionProvider restrictionProvider;
-
-    // @Reference
-    protected void bindRestrictionProvider(RestrictionProvider rp) {
-        this.restrictionProvider = rp;
-    }
-
-    /**
-     * Return the RestrictionProvider service
-     */
-    protected RestrictionProvider getRestrictionProvider() {
-        return restrictionProvider;
-    }
+public abstract class AbstractAccessGetServlet extends AbstractAccessServlet {
 
     /* (non-Javadoc)
      * @see org.apache.sling.api.servlets.SlingSafeMethodsServlet#doGet(org.apache.sling.api.SlingHttpServletRequest, org.apache.sling.api.SlingHttpServletResponse)
diff --git a/src/main/java/org/apache/sling/jcr/jackrabbit/accessmanager/post/AbstractAccessPostServlet.java b/src/main/java/org/apache/sling/jcr/jackrabbit/accessmanager/post/AbstractAccessPostServlet.java
index 50bead1..95d2bf3 100644
--- a/src/main/java/org/apache/sling/jcr/jackrabbit/accessmanager/post/AbstractAccessPostServlet.java
+++ b/src/main/java/org/apache/sling/jcr/jackrabbit/accessmanager/post/AbstractAccessPostServlet.java
@@ -39,7 +39,6 @@
 import org.apache.sling.api.request.header.MediaRangeList;
 import org.apache.sling.api.resource.ResourceNotFoundException;
 import org.apache.sling.api.resource.ResourceUtil;
-import org.apache.sling.api.servlets.SlingAllMethodsServlet;
 import org.apache.sling.api.wrappers.SlingRequestPaths;
 import org.apache.sling.jcr.jackrabbit.accessmanager.impl.PrincipalAceHelper;
 import org.apache.sling.servlets.post.AbstractPostResponse;
@@ -57,7 +56,7 @@
 /**
  * Base class for all the POST servlets for the AccessManager operations
  */
-public abstract class AbstractAccessPostServlet extends SlingAllMethodsServlet {
+public abstract class AbstractAccessPostServlet extends AbstractAccessServlet {
     private static final long serialVersionUID = -5918670409789895333L;
 
     /**
diff --git a/src/main/java/org/apache/sling/jcr/jackrabbit/accessmanager/post/AbstractAccessServlet.java b/src/main/java/org/apache/sling/jcr/jackrabbit/accessmanager/post/AbstractAccessServlet.java
new file mode 100644
index 0000000..a330d96
--- /dev/null
+++ b/src/main/java/org/apache/sling/jcr/jackrabbit/accessmanager/post/AbstractAccessServlet.java
@@ -0,0 +1,63 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to You under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.sling.jcr.jackrabbit.accessmanager.post;
+
+import java.util.HashSet;
+import java.util.Set;
+
+import org.apache.jackrabbit.oak.spi.security.authorization.restriction.CompositeRestrictionProvider;
+import org.apache.jackrabbit.oak.spi.security.authorization.restriction.RestrictionProvider;
+import org.apache.sling.api.servlets.SlingAllMethodsServlet;
+
+/**
+ * Base class for all the servlets for the AccessManager operations
+ */
+public abstract class AbstractAccessServlet extends SlingAllMethodsServlet {
+    private static final long serialVersionUID = 6615497265938616188L;
+
+    private transient RestrictionProvider compositeRestrictionProvider = null;
+    private transient Set<RestrictionProvider> restrictionProviders = new HashSet<>();
+
+    // @Reference
+    protected void bindRestrictionProvider(RestrictionProvider rp) {
+        synchronized (restrictionProviders) {
+            if (restrictionProviders.add(rp)) {
+                compositeRestrictionProvider = null;
+            }
+        }
+    }
+    protected void unbindRestrictionProvider(RestrictionProvider rp) {
+        synchronized (restrictionProviders) {
+            if (restrictionProviders.remove(rp)) {
+                compositeRestrictionProvider = null;
+            }
+        }
+    }
+
+    /**
+     * Return the RestrictionProvider service
+     */
+    protected RestrictionProvider getRestrictionProvider() {
+        synchronized (restrictionProviders) {
+            if (compositeRestrictionProvider == null) {
+                compositeRestrictionProvider = CompositeRestrictionProvider.newInstance(restrictionProviders);
+            }
+            return compositeRestrictionProvider;
+        }
+    }
+
+}
diff --git a/src/main/java/org/apache/sling/jcr/jackrabbit/accessmanager/post/AbstractGetAceServlet.java b/src/main/java/org/apache/sling/jcr/jackrabbit/accessmanager/post/AbstractGetAceServlet.java
index a200611..906c3aa 100644
--- a/src/main/java/org/apache/sling/jcr/jackrabbit/accessmanager/post/AbstractGetAceServlet.java
+++ b/src/main/java/org/apache/sling/jcr/jackrabbit/accessmanager/post/AbstractGetAceServlet.java
@@ -39,7 +39,7 @@
 import org.apache.sling.jcr.jackrabbit.accessmanager.impl.JsonConvert;
 import org.apache.sling.jcr.jackrabbit.accessmanager.impl.PrivilegesHelper;
 
-@SuppressWarnings("serial")
+@SuppressWarnings({"serial", "java:S110"})
 public abstract class AbstractGetAceServlet extends AbstractAccessGetServlet {
 
     @Override
diff --git a/src/main/java/org/apache/sling/jcr/jackrabbit/accessmanager/post/AbstractGetAclServlet.java b/src/main/java/org/apache/sling/jcr/jackrabbit/accessmanager/post/AbstractGetAclServlet.java
index 910c364..684f734 100644
--- a/src/main/java/org/apache/sling/jcr/jackrabbit/accessmanager/post/AbstractGetAclServlet.java
+++ b/src/main/java/org/apache/sling/jcr/jackrabbit/accessmanager/post/AbstractGetAclServlet.java
@@ -44,7 +44,7 @@
 import org.apache.sling.jcr.jackrabbit.accessmanager.impl.JsonConvert;
 import org.apache.sling.jcr.jackrabbit.accessmanager.impl.PrivilegesHelper;
 
-@SuppressWarnings("serial")
+@SuppressWarnings({"serial", "java:S110"})
 public abstract class AbstractGetAclServlet extends AbstractAccessGetServlet {
 
     /**
diff --git a/src/main/java/org/apache/sling/jcr/jackrabbit/accessmanager/post/DeleteAcesServlet.java b/src/main/java/org/apache/sling/jcr/jackrabbit/accessmanager/post/DeleteAcesServlet.java
index 62cf981..167dc45 100644
--- a/src/main/java/org/apache/sling/jcr/jackrabbit/accessmanager/post/DeleteAcesServlet.java
+++ b/src/main/java/org/apache/sling/jcr/jackrabbit/accessmanager/post/DeleteAcesServlet.java
@@ -92,6 +92,7 @@
                     policyOption = ReferencePolicyOption.GREEDY,
                     service = PostResponseCreator.class)
     })
+@SuppressWarnings("java:S110")
 public class DeleteAcesServlet extends AbstractAccessPostServlet implements DeleteAces {
     private static final long serialVersionUID = 3784866802938282971L;
 
diff --git a/src/main/java/org/apache/sling/jcr/jackrabbit/accessmanager/post/GetAceServlet.java b/src/main/java/org/apache/sling/jcr/jackrabbit/accessmanager/post/GetAceServlet.java
index 17cc42c..af8ba7a 100644
--- a/src/main/java/org/apache/sling/jcr/jackrabbit/accessmanager/post/GetAceServlet.java
+++ b/src/main/java/org/apache/sling/jcr/jackrabbit/accessmanager/post/GetAceServlet.java
@@ -35,6 +35,8 @@
 import org.apache.sling.jcr.jackrabbit.accessmanager.GetAce;
 import org.osgi.service.component.annotations.Component;
 import org.osgi.service.component.annotations.Reference;
+import org.osgi.service.component.annotations.ReferenceCardinality;
+import org.osgi.service.component.annotations.ReferencePolicyOption;
 
 /**
  * <p>
@@ -79,6 +81,8 @@
 reference = {
         @Reference(name="RestrictionProvider",
                 bind = "bindRestrictionProvider",
+                cardinality = ReferenceCardinality.MULTIPLE,
+                policyOption = ReferencePolicyOption.GREEDY,
                 service = RestrictionProvider.class)
 }
 )
diff --git a/src/main/java/org/apache/sling/jcr/jackrabbit/accessmanager/post/GetAclServlet.java b/src/main/java/org/apache/sling/jcr/jackrabbit/accessmanager/post/GetAclServlet.java
index d325c42..8a84876 100644
--- a/src/main/java/org/apache/sling/jcr/jackrabbit/accessmanager/post/GetAclServlet.java
+++ b/src/main/java/org/apache/sling/jcr/jackrabbit/accessmanager/post/GetAclServlet.java
@@ -33,6 +33,8 @@
 import org.apache.sling.jcr.jackrabbit.accessmanager.GetAcl;
 import org.osgi.service.component.annotations.Component;
 import org.osgi.service.component.annotations.Reference;
+import org.osgi.service.component.annotations.ReferenceCardinality;
+import org.osgi.service.component.annotations.ReferencePolicyOption;
 
 /**
  * <p>
@@ -107,6 +109,8 @@
 reference = {
         @Reference(name="RestrictionProvider",
                 bind = "bindRestrictionProvider",
+                cardinality = ReferenceCardinality.MULTIPLE,
+                policyOption = ReferencePolicyOption.GREEDY,
                 service = RestrictionProvider.class)
 }
 )
diff --git a/src/main/java/org/apache/sling/jcr/jackrabbit/accessmanager/post/GetEffectiveAceServlet.java b/src/main/java/org/apache/sling/jcr/jackrabbit/accessmanager/post/GetEffectiveAceServlet.java
index 738bd8a..de04f85 100644
--- a/src/main/java/org/apache/sling/jcr/jackrabbit/accessmanager/post/GetEffectiveAceServlet.java
+++ b/src/main/java/org/apache/sling/jcr/jackrabbit/accessmanager/post/GetEffectiveAceServlet.java
@@ -38,6 +38,8 @@
 import org.apache.sling.jcr.jackrabbit.accessmanager.impl.JsonConvert;
 import org.osgi.service.component.annotations.Component;
 import org.osgi.service.component.annotations.Reference;
+import org.osgi.service.component.annotations.ReferenceCardinality;
+import org.osgi.service.component.annotations.ReferencePolicyOption;
 
 /**
  * <p>
@@ -82,6 +84,8 @@
 reference = {
         @Reference(name="RestrictionProvider",
                 bind = "bindRestrictionProvider",
+                cardinality = ReferenceCardinality.MULTIPLE,
+                policyOption = ReferencePolicyOption.GREEDY,
                 service = RestrictionProvider.class)
 }
 )
diff --git a/src/main/java/org/apache/sling/jcr/jackrabbit/accessmanager/post/GetEffectiveAclServlet.java b/src/main/java/org/apache/sling/jcr/jackrabbit/accessmanager/post/GetEffectiveAclServlet.java
index 224de8b..ed7677f 100644
--- a/src/main/java/org/apache/sling/jcr/jackrabbit/accessmanager/post/GetEffectiveAclServlet.java
+++ b/src/main/java/org/apache/sling/jcr/jackrabbit/accessmanager/post/GetEffectiveAclServlet.java
@@ -35,6 +35,8 @@
 import org.apache.sling.jcr.jackrabbit.accessmanager.impl.JsonConvert;
 import org.osgi.service.component.annotations.Component;
 import org.osgi.service.component.annotations.Reference;
+import org.osgi.service.component.annotations.ReferenceCardinality;
+import org.osgi.service.component.annotations.ReferencePolicyOption;
 
 /**
  * <p>
@@ -109,6 +111,8 @@
 reference = {
         @Reference(name="RestrictionProvider",
                 bind = "bindRestrictionProvider",
+                cardinality = ReferenceCardinality.MULTIPLE,
+                policyOption = ReferencePolicyOption.GREEDY,
                 service = RestrictionProvider.class)
 }
 )
diff --git a/src/main/java/org/apache/sling/jcr/jackrabbit/accessmanager/post/GetPrincipalAceServlet.java b/src/main/java/org/apache/sling/jcr/jackrabbit/accessmanager/post/GetPrincipalAceServlet.java
index 4d40d88..44610c4 100644
--- a/src/main/java/org/apache/sling/jcr/jackrabbit/accessmanager/post/GetPrincipalAceServlet.java
+++ b/src/main/java/org/apache/sling/jcr/jackrabbit/accessmanager/post/GetPrincipalAceServlet.java
@@ -43,6 +43,8 @@
 import org.jetbrains.annotations.Nullable;
 import org.osgi.service.component.annotations.Component;
 import org.osgi.service.component.annotations.Reference;
+import org.osgi.service.component.annotations.ReferenceCardinality;
+import org.osgi.service.component.annotations.ReferencePolicyOption;
 
 /**
  * <p>
@@ -87,6 +89,8 @@
 reference = {
         @Reference(name="RestrictionProvider",
                 bind = "bindRestrictionProvider",
+                cardinality = ReferenceCardinality.MULTIPLE,
+                policyOption = ReferencePolicyOption.GREEDY,
                 service = RestrictionProvider.class)
 }
 )
diff --git a/src/main/java/org/apache/sling/jcr/jackrabbit/accessmanager/post/ModifyAceServlet.java b/src/main/java/org/apache/sling/jcr/jackrabbit/accessmanager/post/ModifyAceServlet.java
index 13abd0a..9669aa4 100644
--- a/src/main/java/org/apache/sling/jcr/jackrabbit/accessmanager/post/ModifyAceServlet.java
+++ b/src/main/java/org/apache/sling/jcr/jackrabbit/accessmanager/post/ModifyAceServlet.java
@@ -71,7 +71,6 @@
 import org.osgi.service.component.annotations.Component;
 import org.osgi.service.component.annotations.Reference;
 import org.osgi.service.component.annotations.ReferenceCardinality;
-import org.osgi.service.component.annotations.ReferencePolicy;
 import org.osgi.service.component.annotations.ReferencePolicyOption;
 
 /**
@@ -135,7 +134,20 @@
         "sling.servlet.methods=POST",
         "sling.servlet.selectors=modifyAce",
         "sling.servlet.prefix:Integer=-1"
+},
+reference = {
+        @Reference(name="RestrictionProvider",
+                bind = "bindRestrictionProvider",
+                cardinality = ReferenceCardinality.MULTIPLE,
+                policyOption = ReferencePolicyOption.GREEDY,
+                service = RestrictionProvider.class),
+        @Reference(name = "PostResponseCreator",
+                bind = "bindPostResponseCreator",
+                cardinality = ReferenceCardinality.MULTIPLE,
+                policyOption = ReferencePolicyOption.GREEDY,
+                service = PostResponseCreator.class)
 })
+@SuppressWarnings("java:S110")
 public class ModifyAceServlet extends AbstractAccessPostServlet implements ModifyAce {
     private static final long serialVersionUID = -9182485466670280437L;
     private static final String INVALID_OR_NOT_SUPPORTED_RESTRICTION_NAME_WAS_SUPPLIED = "Invalid restriction name was supplied";
@@ -196,38 +208,6 @@
     private static final Pattern RESTRICTION_PATTERN_DELETE = Pattern.compile(String.format("^restriction@([^@]+)(@([^@]+))?%s$",
                 SlingPostConstants.SUFFIX_DELETE));
 
-    private transient RestrictionProvider restrictionProvider = null;
-
-    // NOTE: the @Reference annotation is not inherited, so subclasses will need to override the #bindRestrictionProvider 
-    // and #unbindRestrictionProvider methods to provide the @Reference annotation.     
-    //
-    @Reference(cardinality=ReferenceCardinality.OPTIONAL, policy = ReferencePolicy.DYNAMIC, policyOption=ReferencePolicyOption.GREEDY)
-    protected void bindRestrictionProvider(RestrictionProvider rp) {
-        this.restrictionProvider = rp;
-    }
-    protected void unbindRestrictionProvider(RestrictionProvider rp) { //NOSONAR
-        this.restrictionProvider = null;
-    }
-
-    /**
-     * Overridden since the @Reference annotation is not inherited from the super method
-     */
-    @Override
-    @Reference(service = PostResponseCreator.class,
-        cardinality = ReferenceCardinality.MULTIPLE,
-        policy = ReferencePolicy.DYNAMIC)
-    protected void bindPostResponseCreator(PostResponseCreator creator, Map<String, Object> properties) {
-        super.bindPostResponseCreator(creator, properties);
-    }
-
-    /* (non-Javadoc)
-     * @see org.apache.sling.jackrabbit.usermanager.impl.post.AbstractPostServlet#unbindPostResponseCreator(org.apache.sling.servlets.post.PostResponseCreator, java.util.Map)
-     */
-    @Override
-    protected void unbindPostResponseCreator(PostResponseCreator creator, Map<String, Object> properties) { //NOSONAR
-        super.unbindPostResponseCreator(creator, properties);
-    }
-
     /* (non-Javadoc)
      * @see org.apache.sling.jackrabbit.accessmanager.post.AbstractAccessPostServlet#handleOperation(org.apache.sling.api.SlingHttpServletRequest, org.apache.sling.servlets.post.PostResponse, java.util.List)
      */
@@ -277,7 +257,7 @@
             throw new RepositoryException("JCR Session not found");
         }
 
-        if (restrictionProvider == null) {
+        if (RestrictionProvider.EMPTY.equals(getRestrictionProvider())) {
             throw new IllegalStateException("No restriction provider is available so unable to process POSTed restriction values");
         }
 
@@ -310,7 +290,7 @@
      * @return map of restriction names to definition
      */
     protected @NotNull Map<String, RestrictionDefinition> buildRestrictionNameToDefinitionMap(@NotNull String resourcePath) {
-        Set<RestrictionDefinition> supportedRestrictions = restrictionProvider.getSupportedRestrictions(resourcePath);
+        Set<RestrictionDefinition> supportedRestrictions = getRestrictionProvider().getSupportedRestrictions(resourcePath);
         Map<String, RestrictionDefinition> srMap = new HashMap<>();
         for (RestrictionDefinition restrictionDefinition : supportedRestrictions) {
             srMap.put(restrictionDefinition.getName(), restrictionDefinition);
diff --git a/src/main/java/org/apache/sling/jcr/jackrabbit/accessmanager/post/ModifyPrincipalAceServlet.java b/src/main/java/org/apache/sling/jcr/jackrabbit/accessmanager/post/ModifyPrincipalAceServlet.java
index 8799ddb..4963693 100644
--- a/src/main/java/org/apache/sling/jcr/jackrabbit/accessmanager/post/ModifyPrincipalAceServlet.java
+++ b/src/main/java/org/apache/sling/jcr/jackrabbit/accessmanager/post/ModifyPrincipalAceServlet.java
@@ -112,6 +112,8 @@
 reference = {
         @Reference(name="RestrictionProvider",
                 bind = "bindRestrictionProvider",
+                cardinality = ReferenceCardinality.MULTIPLE,
+                policyOption = ReferencePolicyOption.GREEDY,
                 service = RestrictionProvider.class),
         @Reference(name = "PostResponseCreator",
                 bind = "bindPostResponseCreator",
diff --git a/src/test/java/org/apache/sling/jcr/jackrabbit/accessmanager/impl/JsonConvertTest.java b/src/test/java/org/apache/sling/jcr/jackrabbit/accessmanager/impl/JsonConvertTest.java
index 1ad476f..f64bf77 100644
--- a/src/test/java/org/apache/sling/jcr/jackrabbit/accessmanager/impl/JsonConvertTest.java
+++ b/src/test/java/org/apache/sling/jcr/jackrabbit/accessmanager/impl/JsonConvertTest.java
@@ -46,6 +46,7 @@
 
 import org.apache.jackrabbit.oak.security.authorization.restriction.RestrictionProviderImpl;
 import org.apache.jackrabbit.oak.spi.security.authorization.accesscontrol.AccessControlConstants;
+import org.apache.jackrabbit.oak.spi.security.authorization.restriction.CompositeRestrictionProvider;
 import org.apache.jackrabbit.oak.spi.security.authorization.restriction.RestrictionDefinition;
 import org.apache.jackrabbit.oak.spi.security.authorization.restriction.RestrictionProvider;
 import org.apache.jackrabbit.oak.spi.security.principal.PrincipalImpl;
@@ -56,6 +57,7 @@
 import org.apache.sling.jcr.jackrabbit.accessmanager.LocalRestriction;
 import org.apache.sling.testing.mock.sling.ResourceResolverType;
 import org.apache.sling.testing.mock.sling.junit.SlingContext;
+import org.jetbrains.annotations.NotNull;
 import org.junit.Before;
 import org.junit.Rule;
 import org.junit.Test;
@@ -86,7 +88,9 @@
     private RestrictionDefinition rd(String restrictionName) {
         if (srMap == null) {
             //make a temp map for quick lookup below
-            RestrictionProvider restrictionProvider = context.getService(RestrictionProvider.class);
+            @NotNull
+            RestrictionProvider[] services = context.getServices(RestrictionProvider.class, null);
+            RestrictionProvider restrictionProvider = CompositeRestrictionProvider.newInstance(services);
             Set<RestrictionDefinition> supportedRestrictions = restrictionProvider.getSupportedRestrictions("/");
             srMap = new HashMap<>();
             for (RestrictionDefinition restrictionDefinition : supportedRestrictions) {
diff --git a/src/test/java/org/apache/sling/jcr/jackrabbit/accessmanager/impl/PrivilegesHelperTest.java b/src/test/java/org/apache/sling/jcr/jackrabbit/accessmanager/impl/PrivilegesHelperTest.java
index 1d085b0..666082a 100644
--- a/src/test/java/org/apache/sling/jcr/jackrabbit/accessmanager/impl/PrivilegesHelperTest.java
+++ b/src/test/java/org/apache/sling/jcr/jackrabbit/accessmanager/impl/PrivilegesHelperTest.java
@@ -42,6 +42,7 @@
 
 import org.apache.jackrabbit.oak.security.authorization.restriction.RestrictionProviderImpl;
 import org.apache.jackrabbit.oak.spi.security.authorization.accesscontrol.AccessControlConstants;
+import org.apache.jackrabbit.oak.spi.security.authorization.restriction.CompositeRestrictionProvider;
 import org.apache.jackrabbit.oak.spi.security.authorization.restriction.RestrictionDefinition;
 import org.apache.jackrabbit.oak.spi.security.authorization.restriction.RestrictionProvider;
 import org.apache.jackrabbit.oak.spi.security.privilege.PrivilegeConstants;
@@ -51,6 +52,7 @@
 import org.apache.sling.jcr.jackrabbit.accessmanager.LocalRestriction;
 import org.apache.sling.testing.mock.sling.ResourceResolverType;
 import org.apache.sling.testing.mock.sling.junit.SlingContext;
+import org.jetbrains.annotations.NotNull;
 import org.jetbrains.annotations.Nullable;
 import org.junit.Before;
 import org.junit.Rule;
@@ -82,7 +84,9 @@
     private RestrictionDefinition rd(String restrictionName) {
         if (srMap == null) {
             //make a temp map for quick lookup below
-            RestrictionProvider restrictionProvider = context.getService(RestrictionProvider.class);
+            @NotNull
+            RestrictionProvider[] services = context.getServices(RestrictionProvider.class, null);
+            RestrictionProvider restrictionProvider = CompositeRestrictionProvider.newInstance(services);
             Set<RestrictionDefinition> supportedRestrictions = restrictionProvider.getSupportedRestrictions("/");
             srMap = new HashMap<>();
             for (RestrictionDefinition restrictionDefinition : supportedRestrictions) {
diff --git a/src/test/java/org/apache/sling/jcr/jackrabbit/accessmanager/it/CustomRestrictionProviderImpl.java b/src/test/java/org/apache/sling/jcr/jackrabbit/accessmanager/it/CustomRestrictionProviderImpl.java
new file mode 100644
index 0000000..252d62c
--- /dev/null
+++ b/src/test/java/org/apache/sling/jcr/jackrabbit/accessmanager/it/CustomRestrictionProviderImpl.java
@@ -0,0 +1,106 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.sling.jcr.jackrabbit.accessmanager.it;
+
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Set;
+
+import org.apache.jackrabbit.oak.api.PropertyState;
+import org.apache.jackrabbit.oak.api.Tree;
+import org.apache.jackrabbit.oak.api.Type;
+import org.apache.jackrabbit.oak.spi.security.authorization.restriction.AbstractRestrictionProvider;
+import org.apache.jackrabbit.oak.spi.security.authorization.restriction.Restriction;
+import org.apache.jackrabbit.oak.spi.security.authorization.restriction.RestrictionDefinition;
+import org.apache.jackrabbit.oak.spi.security.authorization.restriction.RestrictionDefinitionImpl;
+import org.apache.jackrabbit.oak.spi.security.authorization.restriction.RestrictionPattern;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * Sample implementation of the RestrictionProvider interface to test that
+ * custom restrictions can be used.
+ */
+public class CustomRestrictionProviderImpl extends AbstractRestrictionProvider {
+    private final Logger logger = LoggerFactory.getLogger(getClass());
+
+    public static final String SLING_CUSTOM_RESTRICTION = "sling:customRestriction";
+
+    public CustomRestrictionProviderImpl() {
+        super(supportedRestrictions());
+    }
+
+    private static Map<String, RestrictionDefinition> supportedRestrictions() {
+        RestrictionDefinition slingCustomRestriction = new RestrictionDefinitionImpl(SLING_CUSTOM_RESTRICTION, Type.STRINGS, false);
+        Map<String, RestrictionDefinition> supportedRestrictions = new HashMap<String, RestrictionDefinition>();
+        supportedRestrictions.put(slingCustomRestriction.getName(), slingCustomRestriction);
+        return Collections.unmodifiableMap(supportedRestrictions);
+    }
+
+    @Override
+    public RestrictionPattern getPattern(String oakPath, Tree tree) {
+        if (oakPath != null) {
+            PropertyState resourceTypes = tree.getProperty(SLING_CUSTOM_RESTRICTION);
+            if (resourceTypes != null) {
+                CustomRestrictionPattern resourceTypePattern = new CustomRestrictionPattern();
+                logger.trace("Returning resourceTypePattern={} for sling:customRestriction in getPattern(String,Tree)", resourceTypePattern);
+                return resourceTypePattern;
+            }
+        }
+        return RestrictionPattern.EMPTY;
+    }
+
+    @Override
+    public RestrictionPattern getPattern(String oakPath, Set<Restriction> restrictions) {
+        if (oakPath != null && !restrictions.isEmpty()) {
+            for (Restriction r : restrictions) {
+                String name = r.getDefinition().getName();
+                if (SLING_CUSTOM_RESTRICTION.equals(name)) {
+                    CustomRestrictionPattern resourceTypePattern = new CustomRestrictionPattern();
+                    logger.trace(
+                            "Returning resourceTypePattern={} for sling:customRestriction in getPattern(String,Set<Restriction>)",
+                            resourceTypePattern);
+                    return resourceTypePattern;
+                }
+            }
+        }
+
+        return RestrictionPattern.EMPTY;
+    }
+
+    /** Implementation of the {@link RestrictionPattern} interface that returns {@code false} */
+    public static class CustomRestrictionPattern implements RestrictionPattern {
+
+        @Override
+        public boolean matches(Tree tree, PropertyState property) {
+            return false;
+        }
+
+        @Override
+        public boolean matches(String path) {
+            return false;
+        }
+
+        @Override
+        public boolean matches() {
+            return false;
+        }
+
+    }
+
+}
diff --git a/src/test/java/org/apache/sling/jcr/jackrabbit/accessmanager/it/ModifyAceIT.java b/src/test/java/org/apache/sling/jcr/jackrabbit/accessmanager/it/ModifyAceIT.java
index 0f36503..63266ec 100644
--- a/src/test/java/org/apache/sling/jcr/jackrabbit/accessmanager/it/ModifyAceIT.java
+++ b/src/test/java/org/apache/sling/jcr/jackrabbit/accessmanager/it/ModifyAceIT.java
@@ -41,6 +41,7 @@
 
 import org.apache.http.NameValuePair;
 import org.apache.jackrabbit.oak.spi.security.authorization.accesscontrol.AccessControlConstants;
+import org.apache.jackrabbit.oak.spi.security.authorization.restriction.RestrictionProvider;
 import org.apache.jackrabbit.oak.spi.security.privilege.PrivilegeConstants;
 import org.apache.sling.servlets.post.JSONResponse;
 import org.apache.sling.servlets.post.PostResponseCreator;
@@ -63,6 +64,7 @@
 public class ModifyAceIT extends AccessManagerClientTestSupport {
 
     private ServiceRegistration<PostResponseCreator> serviceReg;
+    private ServiceRegistration<RestrictionProvider> serviceReg2;
     private VerifyAce verifyTrue = jsonValue -> assertEquals(ValueType.TRUE, jsonValue.getValueType());
 
     @Before
@@ -72,6 +74,8 @@
         Dictionary<String, Object> props = new Hashtable<>(); // NOSONAR
         serviceReg = bundle.getBundleContext().registerService(PostResponseCreator.class,
                 new CustomPostResponseCreatorImpl(), props);
+        serviceReg2 = bundle.getBundleContext().registerService(RestrictionProvider.class,
+                new CustomRestrictionProviderImpl(), props);
 
         super.before();
     }
@@ -82,6 +86,9 @@
         if (serviceReg != null) {
             serviceReg.unregister();
         }
+        if (serviceReg2 != null) {
+            serviceReg2.unregister();
+        }
 
         super.after();
     }
@@ -2312,4 +2319,50 @@
         assertEquals("javax.jcr.security.AccessControlException: No such privilege invalid_name", jsonObject.getString("status.message"));
     }
 
+    /**
+     * Test to verify adding an ACE with a custom restriction to
+     * the ACL
+     */
+    @Test
+    public void testAddAceWithCustomRestriction() throws IOException, JsonException {
+        testUserId = createTestUser();
+        testFolderUrl = createTestFolder();
+
+        // update the ACE
+        List<NameValuePair> postParams = new AcePostParamsBuilder(testUserId)
+                .withOrder("first")
+                .withPrivilegeRestriction(PrivilegeValues.ALLOW, PrivilegeConstants.JCR_READ,
+                        CustomRestrictionProviderImpl.SLING_CUSTOM_RESTRICTION, new String[] {"item1", "item2"})
+                .withPrivilegeRestriction(PrivilegeValues.DENY, PrivilegeConstants.JCR_WRITE,
+                        CustomRestrictionProviderImpl.SLING_CUSTOM_RESTRICTION, new String[] {"item1", "item2"})
+                .build();
+        addOrUpdateAce(testFolderUrl, postParams);
+
+        JsonObject user = getAce(testFolderUrl, testUserId);
+        assertNotNull(user);
+        assertEquals(testUserId, user.getString("principal"));
+        assertEquals(0, user.getInt("order"));
+
+        JsonObject privilegesObject = user.getJsonObject("privileges");
+        assertNotNull(privilegesObject);
+        assertEquals(2, privilegesObject.size());
+
+        VerifyAce verifyRestrictions = jsonValue -> {
+            assertNotNull(jsonValue);
+            assertTrue(jsonValue instanceof JsonObject);
+            JsonObject restrictionsObj = (JsonObject)jsonValue;
+
+            JsonValue customValue = restrictionsObj.get(CustomRestrictionProviderImpl.SLING_CUSTOM_RESTRICTION);
+            assertNotNull(customValue);
+            assertTrue(customValue instanceof JsonArray);
+            assertEquals(2, ((JsonArray)customValue).size());
+            assertEquals("item1", ((JsonArray)customValue).getString(0));
+            assertEquals("item2", ((JsonArray)customValue).getString(1));
+        };
+        //allow privilege
+        assertPrivilege(privilegesObject, true, PrivilegeValues.ALLOW, PrivilegeConstants.JCR_READ, verifyRestrictions);
+        //deny privilege
+        assertPrivilege(privilegesObject, true, PrivilegeValues.DENY, PrivilegeConstants.JCR_WRITE, verifyRestrictions);
+    }
+
 }
diff --git a/src/test/java/org/apache/sling/jcr/jackrabbit/accessmanager/post/AbstractAccessServletTest.java b/src/test/java/org/apache/sling/jcr/jackrabbit/accessmanager/post/AbstractAccessServletTest.java
new file mode 100644
index 0000000..a684e02
--- /dev/null
+++ b/src/test/java/org/apache/sling/jcr/jackrabbit/accessmanager/post/AbstractAccessServletTest.java
@@ -0,0 +1,84 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to You under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.sling.jcr.jackrabbit.accessmanager.post;
+
+import static org.junit.Assert.*;
+
+import org.apache.jackrabbit.oak.spi.security.authorization.restriction.CompositeRestrictionProvider;
+import org.apache.jackrabbit.oak.spi.security.authorization.restriction.RestrictionProvider;
+import org.apache.sling.jcr.jackrabbit.accessmanager.it.CustomRestrictionProviderImpl;
+import org.junit.Test;
+
+/**
+ * Simple test of the common AbstractAccessServlet
+ */
+public class AbstractAccessServletTest {
+
+    @Test
+    public void testBindRestrictionProvider() {
+        TestAccessServlet tas = new TestAccessServlet();
+
+        //starts out empty
+        assertEquals("Expected the empty RestrictionProvider", RestrictionProvider.EMPTY, tas.getRestrictionProvider());
+
+        //switch from empty to the single custom restriction provider
+        CustomRestrictionProviderImpl customRestrictionProvider = new CustomRestrictionProviderImpl();
+        tas.bindRestrictionProvider(customRestrictionProvider);
+        assertEquals("Expected the custom RestrictionProvider", customRestrictionProvider, tas.getRestrictionProvider());
+
+        //binding the same again doesn't change the state
+        tas.bindRestrictionProvider(customRestrictionProvider);
+        assertEquals("Expected the custom RestrictionProvider", customRestrictionProvider, tas.getRestrictionProvider());
+
+        // binding a second unique obj switces to a CompositeRestrictionProvider
+        CustomRestrictionProviderImpl customRestrictionProvider2 = new CustomRestrictionProviderImpl();
+        tas.bindRestrictionProvider(customRestrictionProvider2);
+        assertNotEquals("Expected the custom RestrictionProvider", customRestrictionProvider, tas.getRestrictionProvider());
+        assertTrue(tas.getRestrictionProvider() instanceof CompositeRestrictionProvider);
+    }
+
+    @Test
+    public void testUnbindRestrictionProvider() {
+        TestAccessServlet tas = new TestAccessServlet();
+        CustomRestrictionProviderImpl customRestrictionProvider = new CustomRestrictionProviderImpl();
+        tas.bindRestrictionProvider(customRestrictionProvider);
+        CustomRestrictionProviderImpl customRestrictionProvider2 = new CustomRestrictionProviderImpl();
+        tas.bindRestrictionProvider(customRestrictionProvider2);
+
+        //unbinding one of them switches back to last one left
+        tas.unbindRestrictionProvider(customRestrictionProvider2);
+        assertEquals("Expected the custom RestrictionProvider", customRestrictionProvider, tas.getRestrictionProvider());
+
+        //unbinding the same again doesn't change the state
+        tas.unbindRestrictionProvider(customRestrictionProvider2);
+        assertEquals("Expected the custom RestrictionProvider", customRestrictionProvider, tas.getRestrictionProvider());
+
+        //unbinding the second one switches back to empty
+        tas.unbindRestrictionProvider(customRestrictionProvider);
+        assertEquals("Expected the empty RestrictionProvider", RestrictionProvider.EMPTY, tas.getRestrictionProvider());
+    }
+
+    @Test
+    public void testGetRestrictionProvider() {
+        TestAccessServlet tas = new TestAccessServlet();
+        assertNotNull(tas.getRestrictionProvider());
+    }
+
+    private class TestAccessServlet extends AbstractAccessServlet {
+        private static final long serialVersionUID = -2948341218853558959L;
+    }
+}
diff --git a/src/test/java/org/apache/sling/jcr/jackrabbit/accessmanager/post/LocalPrivilegeTest.java b/src/test/java/org/apache/sling/jcr/jackrabbit/accessmanager/post/LocalPrivilegeTest.java
index 857db6b..b2d6ef4 100644
--- a/src/test/java/org/apache/sling/jcr/jackrabbit/accessmanager/post/LocalPrivilegeTest.java
+++ b/src/test/java/org/apache/sling/jcr/jackrabbit/accessmanager/post/LocalPrivilegeTest.java
@@ -37,6 +37,7 @@
 
 import org.apache.jackrabbit.oak.security.authorization.restriction.RestrictionProviderImpl;
 import org.apache.jackrabbit.oak.spi.security.authorization.accesscontrol.AccessControlConstants;
+import org.apache.jackrabbit.oak.spi.security.authorization.restriction.CompositeRestrictionProvider;
 import org.apache.jackrabbit.oak.spi.security.authorization.restriction.RestrictionDefinition;
 import org.apache.jackrabbit.oak.spi.security.authorization.restriction.RestrictionProvider;
 import org.apache.jackrabbit.oak.spi.security.privilege.PrivilegeConstants;
@@ -46,6 +47,7 @@
 import org.apache.sling.jcr.jackrabbit.accessmanager.LocalRestriction;
 import org.apache.sling.testing.mock.sling.ResourceResolverType;
 import org.apache.sling.testing.mock.sling.junit.SlingContext;
+import org.jetbrains.annotations.NotNull;
 import org.junit.Before;
 import org.junit.Rule;
 import org.junit.Test;
@@ -75,7 +77,9 @@
     private RestrictionDefinition rd(String restrictionName) throws Exception {
         if (srMap == null) {
             //make a temp map for quick lookup below
-            RestrictionProvider restrictionProvider = context.getService(RestrictionProvider.class);
+            @NotNull
+            RestrictionProvider[] services = context.getServices(RestrictionProvider.class, null);
+            RestrictionProvider restrictionProvider = CompositeRestrictionProvider.newInstance(services);
             Set<RestrictionDefinition> supportedRestrictions = restrictionProvider.getSupportedRestrictions("/");
             srMap = new HashMap<>();
             for (RestrictionDefinition restrictionDefinition : supportedRestrictions) {
diff --git a/src/test/java/org/apache/sling/jcr/jackrabbit/accessmanager/post/LocalRestrictionTest.java b/src/test/java/org/apache/sling/jcr/jackrabbit/accessmanager/post/LocalRestrictionTest.java
index dc75978..b0d87ca 100644
--- a/src/test/java/org/apache/sling/jcr/jackrabbit/accessmanager/post/LocalRestrictionTest.java
+++ b/src/test/java/org/apache/sling/jcr/jackrabbit/accessmanager/post/LocalRestrictionTest.java
@@ -34,12 +34,14 @@
 import javax.jcr.ValueFactory;
 
 import org.apache.jackrabbit.oak.security.authorization.restriction.RestrictionProviderImpl;
+import org.apache.jackrabbit.oak.spi.security.authorization.restriction.CompositeRestrictionProvider;
 import org.apache.jackrabbit.oak.spi.security.authorization.restriction.RestrictionDefinition;
 import org.apache.jackrabbit.oak.spi.security.authorization.restriction.RestrictionProvider;
 import org.apache.jackrabbit.value.ValueFactoryImpl;
 import org.apache.sling.jcr.jackrabbit.accessmanager.LocalRestriction;
 import org.apache.sling.testing.mock.sling.ResourceResolverType;
 import org.apache.sling.testing.mock.sling.junit.SlingContext;
+import org.jetbrains.annotations.NotNull;
 import org.junit.Before;
 import org.junit.Rule;
 import org.junit.Test;
@@ -63,7 +65,9 @@
     private RestrictionDefinition rd(String restrictionName) throws Exception {
         if (srMap == null) {
             //make a temp map for quick lookup below
-            RestrictionProvider restrictionProvider = context.getService(RestrictionProvider.class);
+            @NotNull
+            RestrictionProvider[] services = context.getServices(RestrictionProvider.class, null);
+            RestrictionProvider restrictionProvider = CompositeRestrictionProvider.newInstance(services);
             Set<RestrictionDefinition> supportedRestrictions = restrictionProvider.getSupportedRestrictions("/");
             srMap = new HashMap<>();
             for (RestrictionDefinition restrictionDefinition : supportedRestrictions) {