Adobe Experience Manager

We recently had a security assessment that identified brute force vulnerabilities on our dispatcher URL. The assessment showed 190 consecutive login attempts were possible without any blocking mechanisms on /libs/granite/core/content/login.html.As an immediate mitigation, I'm planning to add these Dispatcher deny rules to block direct access to authentication endpoints:  /0300 { /type "deny" /url "/system/sling/login" }/0301 { /type "deny" /url "/system/sling/logout" }/0302 { /type "deny" /url "/libs/granite/core/content/login*" }/0303 { /type "deny" /url "/login*" }/0304 { /type "deny" /url "*/j_security_check*" }/0305 { /type "deny" /url "/j_security_check*" }Are these Dispatcher rules appropriate for blocking brute force attempts on AEM login endpoints?Will blocking /libs/granite/core/content/login.html break any legitimate AEM functionality?What additional AEM-specific configurations can help with brute force protection (rate limiting, account lockout, etc.)?Has anyone im

I would like to establish a user assigned managed identity with my azure subscription which has access to various resources (namely, a keyvault). How do I configure Federated Identity Credentials on this managed identity such that AEMaaCS can leverage it to communicate with my azure resources? Alternatively, is there any way to connect AEMaaCS to Azure Services without a Client Secret or pinned Client Certificate?

Hey folks,I have been trying to set up the universal editor on my local machine to perform authoring of my blocks. I have some custom blocks developed, and for now, I author them on the AEM cloud's Universal editor and publish the demo page to check for any authoring changes on my local ( which has been started by the 'aem up' command ). Yes, I can see any change I make regarding the decoration of these blocks on the go, but to make a change in the content, I need to update it on the Dev instance of my AEM Cloud Service. Then the same content is proxied in my local through the local ( by the grace of 'aem up' ). But is there any way I can make this change on my local and see the changes instantly? Does the underlying architecture allow for doing so?If anybody has an idea of how to solve this problem, please let me know. And there was an article by Adobe to set up a universal editor locally for React apps, I have followed the steps. Running Your Own Universal Editor Service |

Hi Everyone,I am currently working on Adobe Experience Manager 6.5.17 and implementing a custom EventHandler to listen for page deletion events using the PageEvent.EVENT_TOPIC.Here’s a snippet of my code:@8220494(service = EventHandler.class,immediate = true,property = {EventConstants.EVENT_TOPIC + "=" + PageEvent.EVENT_TOPIC})public class PageDeletionEventHandler implements EventHandler {private static final Logger LOG = LoggerFactory.getLogger(PageDeletionEventHandler.class);@9944223public void handleEvent(Event event) {LOG.info("Received event: {}", event.getTopic());PageEvent pageEvent = PageEvent.fromEvent(event);for (PageModification mod : pageEvent.getModifications()) {if (mod.getType() == PageModification.ModificationType.DELETED) {LOG.info("Page deleted at path: {}", mod.getPath());}}}} The handleEvent method is triggered correctly for CREATED and MODIFIED events - but not for DELETED events when I delete pages via the AEM Sites console.The bundle is active, the component

Uncaught TypeError: Cannot read properties of null (reading 'innerText')at HTMLElement._onOverlayToggle (coralui3.js:940:484)at Vent._executeListenersAtElement (coralui3.js:249:294)at Vent._executeBubbleListeners (coralui3.js:252:219)at Coral.Component.trigger (coralui3.js:354:7)at openComplete (coralui3.js:399:29)at coralui3.js:399:143 I am getting this issue when accessing dropdown in authoring field ,any one suggest the solution for this

carousel panel item name issue:i have inherited carousel component and created custom component and carousel panel select is impacted.custom component panel select is only showing child component name only for children's.but core component is showing child component name : item name for children's.i debugged the issue.. when i change custom component jcr title and component name to carousel, it shows proper name in panel select.can anyone suggest what exactly its happening.

Hello Community,I have created RepoInit scripts to create a service user and grant specific permissions. However, for some reason, I am unable to predict the behavior of the granted permissions. Initially, when the script was deployed to the instance, I observed the following permissions in the content repository:Read: YesModify: NoCreate: YesDelete: YesAfter several deployments (with no changes made to the script), I started noticing errors in the logs. Upon checking the permissions in the UserAdmin Console, I saw that the "Create" permission was no longer enabled. The updated permissions were:Read: YesModify: NoCreate: NoDelete: YesHere is the error log that I encountered: ERROR LOG: 2025-07-30 21:25:50.721 ERROR [com.xxx.yyy.aem.core.internal.impl.models.zzzz] RepositoryException while interacting with JCR: /content/project1/en/jcr:content/root/responsivegrid/layout_container_cop/content/layout_container_169/content/layout_container_108/c

Hi all, Let us say my component works fine on Author, but fails on Publish. What are all the ways to debug? I am aware of debug logging and also monitoring network tab using Developer tools.Is looking at the bundles in Felix to see whether bundle is active an option on Publish? Appreciate all your responses, Thanks,RK.

Hi all, Let us say I have created an Experience Fragment. When clients with different view ports require and request it, how AEM sends the right variant of it?Based on client view port the experience and Experience Fragment should be different. So, AEM creates Experience Fragments for each of view port sizes?How does it know which variant should be served for which client? Appreciate all your responses, Thanks,RK.

Error & AEM connection details 

Hi, 6.5 SP22 on prem user here. I am tasked to audit document files (30k+). My approach is to export a file report, then sort by used who uploaded, then modified. Then send a list of files to the user asking to audit their files. The challenge here is - I only want to first see the document files that are not referencing to websites.  Question:1. Can I add a property in the File Report that would display if the file is referencing or not (similar to what Renovator exports)?2. If above is No, what other report can I use / create that will show: Filepath, Uploader, Modifier, Referencing or Not? This has to be a UI solution please.  Thanks 

For one of my poc, I am planning to setup commerce cockpit and CIF components and I want to use Venia commerce store to setup(https://venia.magento.com/). I have downloaded and installed the package from https://github.com/adobe/aem-cif-guides-venia. I am trying to setup cloud config Here is my com.adobe.cq.commerce.graphql.client.impl.GraphqlClientImpl configGraphQL Service Identifier - https://venia.magento.com Commerce Cloud ConfI guess I should update "Catalog Root Category Identifier" . Does anyone know what should be the value for this field ?

Hi all, Let us say my site is integrated with SSO IDP Okta. When use logs in, IDP's login page appears and IDP collects user id and password.IDP authenticates and sends only token to AEM.1. From then for each of the requests from that client how the token is utilized?2. Where is the token stored or passed?3. How is the token mapped to the user? For that user AEM/IDP should not ask for user name and password. Appreciate all your responses, Thanks,RK.

Hello We have a node under each page with the same name. When we create a launch for the page the node also get created in the launch.On Launch promotion we do not want the information of this node to be promoted back to page as the information on this node might have been updated on page and we do not want it to be overridden.Any suggestions how we can achieve this?

I'm working with a custom AEM component that includes the Core Image component (core/wcm/components/image/v3/image) inside it. The component renders correctly and includes the data-cmp-data-layer attribute for anchor tag (for Adobe Data Layer) in some sites, but not in others, even though the component and content were cloned from a working site.For example:In /content/mysite, the image renders inside an <a> tag and includes the data-cmp-data-layer attribute.In /content/clonedsite, the exact same component and authored image show no data-cmp-data-layer attribute in the DOM.And if changes site name to some other names, for some names its working.What I Checked So Far:The cq:dataLayer = true property is present in the template policies for both sites.The image component has the correct sling:resourceType = core/wcm/components/image/v3/imageThe <a> tag wraps the image in both places, but data-cmp-data-layer is missing only in the broken ones.No JS errors in the browser console

Hi, Upon deletion of asset resource, I need to retrieve a property from the resource before it becomes null.I tried this using an Event Listener, Event Handler, ResourceChangeListener, setting up a workflow triggered by a launcher upon deletion, SlingFilter but the resource is null in all these cases. Is there any way other than overlaying Delete Button and obtain the resource details  before asset  is deleted? We are using AEM6.5. TIA.@arunpatidar @santoshsai @estebanbustamante 

Hello, I'm trying to remediate security vulnerabilities in our AEM installation.  I have downloaded the adobe-aem-forms-jee-hotfix-6.5.23.0-win-jboss.zip file, and extracted it, and I'm running the aemforms65_cfp_install.exe file in the Disk1/InstData/VM folder.  The patch kicks off, executes, and succeeds.  I then run configuration manager.  The first issue I faced was that I had to copy the commons-io-2.5.jar file from the \Adobe_Experience_Manager_Forms\sdk\client-libs\thirdparty folder to the configuration manager lib directory.  That got me past my first issue, which was: java.lang.NoClassDefFoundError: org/apache/commons/io/FileUtils. Now that I've moved past that, I'm getting this error: [2025-07-15 11:11:24,100], SEVERE, Thread-6, com.adobe.livecycle.lcm.feature.configureLC.MergeEarsTask, Task failedcom.adobe.livecycle.lcm.core.LCMException[ALC-LCM-010-200]: Failed to merge Ears.at com.adobe.livecycle.lcm.feature.configureLC.Mer

Hi All, I have to display the subform based on the dropdown value and once the subform is visible there are some fields that needs to mandatory. I have tried in all ways but is not working, it would be great if  someone help on it, as the development is on hold. Sample script if(this.rawValue == "Accept"){Page1.Accept.presence = "visible";Page1.Accept.TextField1.mandatory = "error";Page1.Denial.presence = "hidden";Page1.Denial.TextField3.mandatory = "disable";}else if(this.rawValue == "Denial"){Page1.Accept.presence = "hidden";Page1.Accept.TextField1.mandatory = "disable";Page1.Denial.presence = "visible";Page1.Denial.TextField3.mandatory = "error";} Thank you in advance Regards,Apurva 

I would like to confirm whether both task emails and workflow emails use the same SMTP settings. If they do, could you please advise why, in the same environment, only task emails are working while workflow emails are not?

We have created a custom RTE component for linking the test to different links depending on the requirement.So we have created a one extra pop-up on RTE. So for this we have created a js file. In this javascript we also have used underscore js and using for ex  _.isEmpty function. Now after AEM 6.5.10 upgrade it always says "_ is" not defined. We have underscore as a dependency for out clientlibs. This was working with 6.5.5 but after 6.5.10 its not working. I see one difference here is 6.5.5 this lodash contains modern folder with categories lodash, underscore. Now after 6.5.10 this modern folder is missing so these categories are missing. So is this the reason underscore depedency that was added to out existing component is not getting recognised? Thanks,Mahaboob,

Dear community, I am currently working on a project using Edge Delivery Services with AEM as the content source. I have completed the migration of content from my development author environment to production using an AEM package. I have confirmed that both the site structure and assets are visible in the production author instance. The configurations between development and production environments are identical. My main question is:To switch the content source from the development author to the production author, is it sufficient to simply update the fstab file to point to the production author URL?Since the paths.json should remain consistent after the content migration, I would like to confirm if this is the only required step. I want to ensure that this approach will not introduce issues when new content is published from the production author, and that Edge Delivery Services will continue to function as expected without disruptions. Could you please confirm if t

Hi Team,Recently we are seeing an issue on pipeline execution for AEMCS.The execution has been stuck during the deployment to the dev stage for several hours. Has anyone else faced a similar issue?We contacted the support team during the initial occurrence. While they couldn’t identify the root cause, they mentioned that one of the pods was stopped, which they assumed might be the reason.The issue has happened again today, but we haven’t received any feedback from the team yet. We haven’t made any customizations to the pipeline—our code builds successfully locally and has been pushed to the Adobe pipeline.Has anyone else observed a similar problem?Thanks,Geo

Is it possible to logically and securely segregate development, pre-production, and production environments within  Adobe Experience Manager?Specifically:Does this segregation require the configuration of three distinct Adobe Programs, or is there a native way to manage multiple environments within a single Program?Can these environments communicate with each other and with their respective on-premise enviroments?If so, is it necessary to configure three separate VPNs to enable secure communication between each environment and its corresponding on-prem infrastructure? 

 Hi everyone,I’m trying to extend the core Title component core/wcm/components/title/v3/title by adding a dropdown field to its dialog using Sling Resource Merger.Here is what I have done:1. Created a proxy component at /apps/myproject/components/title2. Set sling:resourceSuperType = "core/wcm/components/title/v3/title"3. Created an overlay dialog at:/apps/myproject/components/title/_cq_dialog/.content.xmlAnd I tried adding this dropdown:<jcr:root xmlns:sling="http://sling.apache.org/jcr/sling/1.0" xmlns:jcr="http://www.jcp.org/jcr/1.0" jcr:primaryType="nt:unstructured" sling:resourceSuperType="core/wcm/components/title/v3/title"> <content jcr:primaryType="nt:unstructured"> <items jcr:primaryType="nt:unstructured"> <headingType jcr:primaryType="nt:unstructured" sling:resourceType="granite/ui/components/coral/foundation/form/select" fieldLabel="Heading Type"