RDE environment - authentication issue - login exception

Hi ​@ViaVu 

Root cause:

org.apache.sling.api.resource.LoginException: Cannot derive user name for bundle natixis.core [660] and sub service natixisServices means:

• Sling cannot find a service user mapping for bundle = natixis.core, subservice = natixisServices
• or the mapped system user doesn't exist / has no rights.

On your dev/stage/prod this works because those environments already have:

• A system user (created via repoinit)
• A ServiceUserMapper OSGi config mapping natixis.core:natixisServices → that system user

Your RDE starts as a clean AEM, and only what you deploy via aio aem:rde:install and packages exists there. If you did not deploy the repoinit + service user mapping config into RDE (or they are runmode‑scoped so they don't apply to rde), then only RDE will fail.

Things to check in RDE

On the RDE author:

• Check service user mapping actually exists
  • Go to:
    • /system/console/status-slingserviceusermappings (Status -> Sling Service User Mappings)
    • Look for a line like:  natixis.core : natixisServices -> natixis-service-user
    • If missing, your org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended-*.cfg.json with something like:

      {
        "user.mapping": [
          "natixis.core:natixisServices=[natixis-service-user]"
        ]
      }
      

      is simply not deployed (or not active for RDE).

• Check system user exists

  • In CRX/Repo Browser (or CRXDE if accessible), verify that the mapped user exists, e.g.: /home/users/system/cq:services/natixis/natixis-service-user

  • In AEM as a Cloud Service this user must be created by repoinit, via an OSGi config like:

    {
      "scripts": [
        "create service user natixis-service-user with forced path system/cq:services/natixis",
        "set principal ACL for natixis-service-user \n allow jcr:read,rep:write on /content \n end"
      ]
    }
    

    If this node isn't there in RDE, the repoinit config that creates it hasn't been installed.

• Make sure these configs are deployed into RDE

  • In Cloud projects the above usually lives in:

    • ui.config (or all) as:

      • org.apache.sling.jcr.repoinit.repositoryInitializer~*.cfg.json

      • org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended-*.cfg.json

  • To fix RDE you must:

    • Build your full project (or at least the module that contains both repoinit and mapper config)

    • Deploy it to RDE:

      aio aem:rde:install ./all/target/your-project.all-*.zip
      # or the ui.config/ui.apps package that contains those configs
      

      And avoid runmode suffixes that exclude RDE, e.g. configs named only for dev / stage. Either:

    • Make them runmode‑agnostic, or

    • Include rde in the runmode if you are using runmode-specific config folders.

• Code side

  • Your code should be doing something like:

    Map<String, Object> authInfo = Collections.singletonMap(
        ResourceResolverFactory.SUBSERVICE, "natixisServices");
    try (ResourceResolver rr = resourceResolverFactory.getServiceResourceResolver(authInfo)) {
        ...
    }
    

    Since the stack trace already shows sub service natixisServices, this is probably fine; the problem is almost certainly the missing mapping/user in RDE.