Please help me, how ACLs can be achieved using sling resource type servlet? | Community
Skip to main content
Level 3
October 31, 2022
Solved

Please help me, how ACLs can be achieved using sling resource type servlet?

  • October 31, 2022
  • 1 reply
  • 1314 views

Everyone says that resource type servlet is recommended over path type servlet as there will be benefit of ACLs, can someone explain with an example  how ACLs can be achieved and why resource type servlet is best?

 

This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.
Best answer by arunpatidar

Thanks @shashi_mulugu , but in real time, in which scenario we can use a resource type servlet with paths other than /content ??


Hi,

Resourcetypes-based servlets are recommended not just for ACL reasons, but also for other reasons.

In the case of a path servlet, there is no way to restrict users (OptinServlet can do that but they are very slow and less performant) and an additional dispatcher, OSGIconfig changes are required (if not using predefined whitelisted paths) and they are difficult to manage.

Create a servlet using resourcetype, which is most likely used with the sling:resourceType property via a jcr content resource.

It will be easy to add rep:cugPolicy to restrict in publish or rep:policy to restrict in Author for a few set of users.

For example if you want to create a dashboard/custom landing page in AEM author, you can restrict access based on user group.

If you are using Publish on a site with CUG, you can only allow anonymous users to check login status etc.

 

There are many real time use cases and advantages of resource based servlet. If you are create a resource in JCR, you are enabling capabilities on JCR and Sling.

1 reply

Community Advisor
October 31, 2022
Level 3
October 31, 2022

Thanks for your reply, but, it is not clear mentioned, the actual question is, when there is a requirement to access a resource type servlet by any anonymous user of the website based on some CTA, there is no concept of permissions to that user, in that case how ACLs work? 

Saravanan_Dharmaraj
Community Advisor
Community Advisor
October 31, 2022

If you website is open for anonymous users and any anonymous user can make the call to servlet. There wont any be restriction on permission side.

If you worried about the stopping the servlet call for anonymous users, please check the update #2 in solution link provided by @knan