How to allow/deny access to a libs path in aem as a cloud | Community
Skip to main content
R
ReddyIshanvi
Level 3
August 28, 2022
Solved

How to allow/deny access to a libs path in aem as a cloud

  • August 28, 2022
  • 3 replies
  • 1770 views

I am trying to deny access on a libs path (/libs/cq/core/content/nav/tools/security) using the repoinit and it's working fine on the local SDK but failing the pipeline on the cloud. Any recommendation on how to fix it?

 

Use case : "test-demo" Group is created in admin console and synced to AEM so group already exists in AEM.

The below code is adding to "org.apache.sling.jcr.repoinit.RepositoryInitializer~projectName.cfg.json" :

{
"scripts":[
"set ACL on /libs/cq/core/content/nav/tools/security\r\n deny jcr:read for \"test-demo\"\r\nend"
]
}
 
It works fine on my local but failing a pipeline on cloud. Any recommendations?
This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.
Best answer by Jagadeesh_Prakash

Hi @reddyishanvi 

 

Below one workes. Make sure that the spaces and characters are replaced with encoded format

 

<?xml version="1.0" encoding="UTF-8"?>
<jcr:root xmlns:sling="http://sling.apache.org/jcr/sling/1.0" xmlns:jcr="http://www.jcp.org/jcr/1.0"
          jcr:primaryType="sling:OsgiConfig"
          scripts="[set ACL for content-writer-service&#xa;     allow   jcr:read\,rep:write\,jcr:versionManagement\, jcr:modifyAccessControl\,jcr:readAccessControl\,jcr:lockManagement on /var&#xa; end, set ACL for content-writer-service&#xa;     allow   jcr:read\ on /&#xa; end, set ACL for content-writer-service&#xa;     allow   jcr:read\,rep:write\,jcr:versionManagement\, jcr:modifyAccessControl\,jcr:readAccessControl\,jcr:lockManagement on /etc&#xa; end, set ACL for content-writer-service&#xa;     allow   jcr:read\,rep:write\,jcr:versionManagement\, jcr:modifyAccessControl\,jcr:readAccessControl\,jcr:lockManagement on /content&#xa; end, set ACL for content-reader-service&#xa;     allow   jcr:read\ on /content&#xa; end, set ACL for content-reader-service&#xa;     allow   jcr:read\ on /etc&#xa; end]"/>

 

3 replies

Jagadeesh_Prakash
Community Advisor
Jagadeesh_PrakashCommunity AdvisorAccepted solution
Community Advisor
August 29, 2022

Hi @reddyishanvi 

 

Below one workes. Make sure that the spaces and characters are replaced with encoded format

 

<?xml version="1.0" encoding="UTF-8"?>
<jcr:root xmlns:sling="http://sling.apache.org/jcr/sling/1.0" xmlns:jcr="http://www.jcp.org/jcr/1.0"
          jcr:primaryType="sling:OsgiConfig"
          scripts="[set ACL for content-writer-service&#xa;     allow   jcr:read\,rep:write\,jcr:versionManagement\, jcr:modifyAccessControl\,jcr:readAccessControl\,jcr:lockManagement on /var&#xa; end, set ACL for content-writer-service&#xa;     allow   jcr:read\ on /&#xa; end, set ACL for content-writer-service&#xa;     allow   jcr:read\,rep:write\,jcr:versionManagement\, jcr:modifyAccessControl\,jcr:readAccessControl\,jcr:lockManagement on /etc&#xa; end, set ACL for content-writer-service&#xa;     allow   jcr:read\,rep:write\,jcr:versionManagement\, jcr:modifyAccessControl\,jcr:readAccessControl\,jcr:lockManagement on /content&#xa; end, set ACL for content-reader-service&#xa;     allow   jcr:read\ on /content&#xa; end, set ACL for content-reader-service&#xa;     allow   jcr:read\ on /etc&#xa; end]"/>

 

    HeenaMadan
    Community Advisor and Adobe Champion
    HeenaMadanCommunity Advisor and Adobe Champion
    Community Advisor and Adobe Champion
    August 29, 2022

    Create file in ui.config folder:

    org.apache.sling.jcr.repoinit.RepositoryInitializer-projectinit.config

    scripts=["
# These paths must exist otherwise the following ACL applicaiton will fail, resulting in err'ing build
create path /libs/cq/core/content/nav/tools/security
# Create a group
create group test-demo
set ACL for test-demo
deny jcr:read on /libs/cq/core/content/nav/tools/security

end
"]
      Sachin_Arora_
      Community Advisor
      Sachin_Arora_Community Advisor
      Community Advisor
      August 29, 2022

      Can you please share the error of pipeline failure ?

        Terms & ConditionsAccessibility statement

        Loading footer...