Asset Link Share from AEM - Security and Configuration Questions

Hi,

Please check below:

Asset link sharing

Share assets as a link

If you want to share links from your AEM Author instance to external entities, ensure that you only expose the following URLs (which are specifically used for link sharing) for GET requests only:

• <AEM Server>/linkshare.html
• <AEM Server>/linksharepreview.html
• <AEM Server>/linkexpired.html

Block other URLs to ensure that your Author instance is secure.

Hi Arun,

Yes, that link you provided is where I grabbed the list of pages I mentioned in my original post.  In testing, it appears other paths (e.g. /etc.clientlibs) must also be opened to the public.

My question was more generally asking if allowing public access to the author server for link shares is standard practice, since most author servers sit securely behind a firewall.

Regarding Link Shares, yes, the method of seeing active Link Shares that you mention is how I am viewing them in AEM.  However, I do not see any option to open an existing share to edit it.  Do you?

Hello,

What exactly do you want to edit in that link?

One way is to edit from crx/de. Links are stored at path /var/dam/share. Otherwise, unshare the link and share it again after modifying the properties.

Regards,

Vishu

I don't actually want to "edit" it per-say - I'd like to be able to retrieve the URL so that I can copy and paste it to someone in an email or instant message or something.  I realize the initial share executes an email, but after that point I dont see a way to get ahold of the link.

Also, it seems reasonable that someone would potentially want to extend the expiration of a share.

You can update the expiration date by modifying the expirationDate property of the generated share nodes under - /var/dam/share folder. But I don't think there is a way to get the share URL as it is formed by creating a JWT token leveraging encryption.

Ok, so the simple answers to my questions are...

- No it's not possible to get the link that was shared.

- No you cannot update the expiration of a shared link via the authoring interface (an admin can do it via CRX, but that's not practical for business use).

A bit disappointing, as both of these seem like they would be helpful and simple to implement.  These are the types of things that get me in trouble with clients when they use features like this that were advertised to them...

Anyway, I still have the following two questions from the original post:

- Is it standard practice to allow public access to the AEM Author (limited to required paths) for asset link sharing?

- Is there any way to configure asset link share to omit renditions in the download?

- Is it standard practice to allow public access to the AEM Author (limited to required paths) for asset link sharing?

     -- I don't think so but this is the direction provided by Adobe docs.

- Is there any way to configure asset link share to omit renditions in the download?

     -- I haven't gone through the code but I believe this feature "Allow download of Original file" might help. Otherwise, it should be feasible through customization

Path for shared links: /var/dam/share/ ..... 

You may be able to find more clues at http://localhost:4502/system/console/events 

Even if it doesn't capture the shared link OOB, you could always customize it and add a logger or save it in the node itself as a property under /var/dam/share

Yes, I understand the direction from Adobe, but it seems like an overall bad idea to allow outside world access to the Author which is why Im asking the community if this is "truly" what should be done to enable Asset link Sharing for a client.  If not, then to some extent we're selling vaporware.

The checkbox to include original asset simply updates the download of renditions to *also* include the original - I dont see any option to remove the renditions (which in some cases could be very significant in size and also in some cases might not be desireable to be shared by the client.  Understood that I could customize AEM to do this, but again now I've lost the leverage of an OOTB feature that I can promote to the client because I have to also include development resources to make this feature truly user-friendly to business stakeholders.

Thanks for the confirmation KBWEB​.  This kinda of stuff makes me angry, because the features give an impression that clients can do a certain thing with the platform, but in reality (due to normal, practical reasons) they cannot.  These features have been around long enough that they should be more fully functional than they currently are, and I think it's sad that your team is going to have to build a custom solution, spending the client's money doing so.  Not your fault - Adobe should have these things supported in the OOTB solution.