Enabling Basic Authentication on AEM Publish for a Public URL for Lower Environments | Community
Skip to main content
B
bishnu_satpathy_tcs
Level 2
June 20, 2025
Solved

Enabling Basic Authentication on AEM Publish for a Public URL for Lower Environments

  • June 20, 2025
  • 3 replies
  • 652 views

Hi Team

 

We are looking for a solution to have our lower environments' Public URLs(via Dispatchers) to be brought under authentication.

 

We have enabled basic authentication for the lower environment via dispatcher, however we are implementing the steps manually for each environment. Since following are the constraints.

1. Each lower environment has a different username and password.

2. Also not able checkin to the dispatcher repository as the credentials are different and should not be enabled on the Production environment.

 

It would be of great help, if i get a little assistance on this requirement.

 

Regards

Bishnu

This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.
Best answer by SantoshSai

Hi @bishnu_satpathy_tcs,

Based on my experience with AEM Dispatcher setups and environment-specific authentication, here’s how you can approach this requirement efficiently:

I would recommend:

1. Environment-Specific Configuration Files

  • Keep your Dispatcher configuration modular by splitting authentication-related settings into environment-specific files, e.g.:

    • dispatcher_auth_lower1.conf

    • dispatcher_auth_lower2.conf

  • Your main dispatcher config can include these files conditionally during deployment or startup based on the environment.

2. Use Environment Variables or Deployment Automation

  • When deploying to each environment, inject the correct Basic Auth username and password via deployment scripts or CI/CD pipelines (e.g., Ansible, Jenkins).

  • The pipeline replaces or updates the environment-specific dispatcher config file with the right credentials without checking secrets into version control.

3. Avoid Checking Credentials into Source Control

  • Store the credentials securely in your organization’s secret management system or vault (HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, etc.).

  • Fetch credentials dynamically during deployment rather than hardcoding.

4. Dispatcher Basic Auth Setup Example

In your environment-specific dispatcher config (dispatcher_auth_lower1.conf), you can have something like:

<Location />
    AuthType Basic
    AuthName "Restricted Area"
    AuthUserFile /path/to/env1/.htpasswd
    Require valid-user
</Location>

  • The .htpasswd file contains the username/password hashes for that environment only.

5. Keep Production Free From Auth

  • Simply do not include any Basic Auth config or .htpasswd for production dispatcher config.

  • This keeps production public and unaffected.

3 replies

narendiran_ravi
narendiran_ravi
Level 6
June 20, 2025

Hi @bishnu_satpathy_tcs ,

For AEM as a Cloud Service, refer to the following guide on enabling basic authentication through the CDN:
🔗 Basic Authentication in AEMaaCS CDN

For earlier versions of AEM (on-premise or AMS), refer to this article:
🔗 How to Enable Basic Authentication for AEM and Cloud Manager

    SantoshSai
    Community Advisor
    SantoshSaiCommunity AdvisorAccepted solution
    Community Advisor
    June 22, 2025

    Hi @bishnu_satpathy_tcs,

    Based on my experience with AEM Dispatcher setups and environment-specific authentication, here’s how you can approach this requirement efficiently:

    I would recommend:

    1. Environment-Specific Configuration Files

    • Keep your Dispatcher configuration modular by splitting authentication-related settings into environment-specific files, e.g.:

      • dispatcher_auth_lower1.conf

      • dispatcher_auth_lower2.conf

    • Your main dispatcher config can include these files conditionally during deployment or startup based on the environment.

    2. Use Environment Variables or Deployment Automation

    • When deploying to each environment, inject the correct Basic Auth username and password via deployment scripts or CI/CD pipelines (e.g., Ansible, Jenkins).

    • The pipeline replaces or updates the environment-specific dispatcher config file with the right credentials without checking secrets into version control.

    3. Avoid Checking Credentials into Source Control

    • Store the credentials securely in your organization’s secret management system or vault (HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, etc.).

    • Fetch credentials dynamically during deployment rather than hardcoding.

    4. Dispatcher Basic Auth Setup Example

    In your environment-specific dispatcher config (dispatcher_auth_lower1.conf), you can have something like:

    <Location />
    AuthType Basic
    AuthName "Restricted Area"
    AuthUserFile /path/to/env1/.htpasswd
    Require valid-user
</Location>

    • The .htpasswd file contains the username/password hashes for that environment only.

    5. Keep Production Free From Auth

    • Simply do not include any Basic Auth config or .htpasswd for production dispatcher config.

    • This keeps production public and unaffected.

    Santosh Sai
      B
      bishnu_satpathy_tcsAuthor
      Level 2
      June 23, 2025

      thanks Sathosh.

       

      can I get a little help in executing the script through CI/CD. We are using adobe cloud manager.

       

      kautuk_sahni
      Community Manager
      kautuk_sahniCommunity Manager
      Community Manager
      July 2, 2025

      @bishnu_satpathy_tcs Just checking in — were you able to resolve your issue?
      We’d love to hear how things worked out. If the suggestions above helped, marking a response as correct can guide others with similar questions. And if you found another solution, feel free to share it — your insights could really benefit the community. Thanks again for being part of the conversation!

      Kautuk Sahni
      Terms & ConditionsAccessibility statement

      Loading footer...