AEM LDAP VS SAML VS Custom Login Module
Please validate the below AEM LDAP Vs SAML vs custom login module authentication behaviour ,also provide any additional inputs
In case of LDAP authentication -
AEM provides this as JAAS login module and any LDAP user need not be present in AEM user node and can be directly mapped to LDAP role to AEM user groups which has a single user pre-created(for impersonation) and permissions can be applied to the authenticated user based on mapped groups ACL and end user need not be physically present in AEM .this can avoid publish node user information syncup overhead
In case of SAML authentication -
AEM provides this as an authentication handler and these authenticated users needs to be present in AEM user node which can be auto created as well and dynamically mapped to AEM user groups and permissions can be applied to the authenticated user only if the user is physically present in AEM
Custom Login Module
If LDAP and SAML still needs the user to be created in AEM user node will a custom login module? which can impersonate end user (after 3rd party /enterprise authentication) to the required pre created aem user group be the solution - to have minimal user data in AEM repo and avoid multiple publish sync up overheads
Overall we just want to maintain 20 user node mapped to 20 groups in AEM publish which will map to enterprise wide users in LDAP based on their roles etc or other consumer identity which holds more than 200K user profiles.
Nature of AEM publish is TarMK