Skip to main content
vamshi_mut
vamshi_mut
Level 2
September 23, 2026
Question

AEM Cloud Author Custom Domain and Adobe IMS Authentication Flow

  • September 23, 2026
  • 2 replies
  • 35 views

Hi Community,

I'm currently evaluating options for exposing an AEM Cloud Author environment through a corporate custom domain and would like to hear from anyone who has explored a similar architecture.

I have already raised a support ticket with Adobe. The guidance received was that custom domains for Author are currently not supported and that a customer-managed reverse proxy/gateway approach would be outside the supported AEM configuration. While that clarifies Adobe's support position, I am still trying to better understand the technical feasibility and real-world experiences from the community.

After discussions with our network team, we identified the following approach:

1. Inbound Host Header Rewrite

The reverse proxy intercepts requests to the custom domain and rewrites the HTTP Host header to the Adobe-provided Author hostname so Adobe can correctly route traffic within the multi-tenant environment.

2. Outbound Redirect Rewrite

When AEM issues redirects, the reverse proxy rewrites response Location headers from the Adobe Author hostname back to the custom corporate hostname to keep users on the custom URL.

3. SNI / SSL Pass-through

The reverse proxy passes the Adobe Author hostname as the SNI value during the backend TLS handshake to ensure successful communication with Adobe's edge services.

Our network team is confident that items 1 and 3 are achievable.

However, the challenge appears to be item 2 once the Adobe IMS authentication flow is involved.

Our understanding is:

  • User accesses the custom Author URL.
  • Traffic is routed through the reverse proxy to AEM Author.
  • User is redirected to Adobe IMS for authentication.
  • After successful authentication, the return URL is generated using the Adobe-managed Author hostname.
  • The browser is then redirected to the Adobe hostname rather than the custom domain.

Because this redirect originates from the IMS/AEM authentication flow, our network team believes they may no longer have control over the return URL after authentication completes.

Questions

  • Has anyone successfully implemented a custom domain for AEM Cloud Author using F5, reverse proxy, gateway, or similar technologies?
  • Is the post-IMS authentication callback always tied to the Adobe Author hostname?
  • Has anyone successfully maintained a custom domain throughout the IMS authentication flow?
  • Were any additional redirect, cookie, or header rewrite mechanisms required?
  • Are there any practical workarounds currently being used until native Author custom domain support becomes available?

I would appreciate hearing from anyone who has implemented this in production or evaluated a similar design.

Note: Adobe Support has confirmed that Author custom domains are currently unsupported. An enhancement request (CMGR-18457) exists for this capability, with a tentative future roadmap target, but no committed delivery date is currently available.

2 replies

AmitVishwakarma
Community Advisor
AmitVishwakarmaCommunity Advisor
Community Advisor
September 23, 2026

Hi ​@vamshi_mut 
The supported answer is that custom domains are currently not supported for the AEM as a Cloud Service Author tier. Author access uses a standard, non-customizable Adobe-managed hostname, while Cloud Manager custom-domain support applies to Publish and Preview.

A reverse proxy can technically forward traffic to the Adobe Author hostname and can rewrite some response headers, but this does not make the configuration supported. The backend SNI value only affects the TLS handshake; it does not determine the browser callback URL.

The IMS callback is controlled by the redirect_uri configured and allowed for the relevant IMS client. In a standard Author environment, the Adobe-managed Author hostname is the supported callback target. If a custom hostname is not explicitly registered in the Adobe-side IMS configuration, the login flow may return to the Adobe hostname or fail validation. A proxy cannot reliably solve this by rewriting only the Location header, because the post-login redirect may be returned by IMS directly to the browser and therefore bypass the proxy.

Maintaining the custom hostname throughout the complete flow would require more than Host/SNI/Location rewrites. It would require Adobe-side IMS client configuration, session/cookie validation, and compatibility testing for the AEM web UI and Unified Shell. Those changes are not available as a general self-service Author configuration.

Therefore, the practical supported options are to use the standard Author URL, restrict access using the Author IP Allow List, or use a customer-managed branded redirect where the final browser URL changes to the Adobe Author hostname. Any reverse-proxy solution that keeps the custom URL visible should be treated as an unsupported/manual exception and confirmed with Adobe before production use.

Amit Vishwakarma - Adobe Commerce Champion 2025 | 17x Adobe certified | 6x Adobe SME
vamshi_mut
vamshi_mutAuthor
Level 2
September 23, 2026

Thanks for the response. I understand the support position around Author custom domains.

My question is more about real-world implementation experience. Has anyone actually implemented or tested this approach with F5/reverse proxy and Adobe IMS?

Specifically, is the IMS authentication callback a hard technical blocker, or is this simply an unsupported architecture that can still be made to work?

I'd be interested to hear from anyone who has explored this approach and can share any practical lessons learned.

Terms & ConditionsAccessibility statement

Loading footer...