AssetManager doesn't respect JCR permissions?

You do not have to check permissions,  if permission is denied exception will be thrown.  All you need to make sure is in custom servlet you need to use user session and not admin one.  If you are using user session can you post complete code for review.

We are using the user session, not an administrative session.  The code is attached.

package com.test.services.osgi.servlets; import java.io.IOException; import java.io.InputStream; import java.io.PrintWriter; import java.rmi.ServerException; import org.apache.commons.fileupload.servlet.ServletFileUpload; import org.apache.felix.scr.annotations.sling.SlingServlet; import org.apache.sling.api.SlingHttpServletRequest; import org.apache.sling.api.SlingHttpServletResponse; import org.apache.sling.api.request.RequestParameter; import org.apache.sling.api.resource.ResourceResolver; import org.apache.sling.api.servlets.SlingAllMethodsServlet; import org.slf4j.Logger; import org.slf4j.LoggerFactory; import javax.jcr.Session; import com.day.cq.dam.api.AssetManager; @SlingServlet( paths="/bin/submitFile", methods="POST", metatype=true,name="com.test.services.osgi.servlets.TestServlet" ) public class TestServlet extends SlingAllMethodsServlet { private static final long serialVersionUID = -1L; private static final Logger logger = LoggerFactory.getLogger(TestServlet.class); @Override protected void doPost(SlingHttpServletRequest request, SlingHttpServletResponse response) throws ServerException, IOException { try { final boolean isMultipart = ServletFileUpload.isMultipartContent(request); PrintWriter out = null; out = response.getWriter(); if (isMultipart) { final java.util.Map<String, RequestParameter[]> params = request.getRequestParameterMap(); for (final java.util.Map.Entry<String, RequestParameter[]> pairs : params.entrySet()) { final org.apache.sling.api.request.RequestParameter[] pArr = pairs.getValue(); final org.apache.sling.api.request.RequestParameter param = pArr[0]; final InputStream stream = param.getInputStream(); Session session = request.getResourceResolver().adaptTo(Session.class); // Save the uploaded file into the Adobe CQ DAM out.println("The Sling Servlet placed the uploaded file here: " + writeToDam(request.getResourceResolver(), stream, param.getFileName(), request.getContentType())); } } } catch (Exception e) { e.printStackTrace(); } } // Save the uploaded file into the AEM DAM using AssetManager API private String writeToDam(ResourceResolver resourceResolver, InputStream is, String fileName, String contentType) { try { // Use AssetManager to place the file into the AEM DAM com.day.cq.dam.api.AssetManager assetMgr = resourceResolver.adaptTo(AssetManager.class); String newFile = "/content/dam/test/" + fileName; assetMgr.createAsset(newFile, is, contentType, true); // Return the path to the file was stored return newFile; } catch (Exception e) { e.printStackTrace(); } return null; } }

Sham - anyway you would be able to verify this?  I'm still seeing that JCR permissions are not be recognized by this in AEM 6.