Level 3

Solved

Remove replicate permission for administrators - AEM 6.4

Forum|Forum|5 years ago
June 1, 2020
5 replies
7720 views

Hello AEM Gurus,

We have a requirement to prevent everyone (including administrators) from replicating assets from a certain path under /content/dam. I have removed replicate permission for this path (eg /content/dam/testfldr) for all of the groups including the administrators group. But users in this administrators group are still able to replicate the assets under this path. When I see the permissions for administrators in useradmin for /content/dam/testfldr path, it has a *! markup next to the Replicate checkbox. When I hover over that checkbox, it says "Noneffective administrators (deny)" in a modal popup.

Is it possible to prevent administrators from replicating assets from certain paths? If setting permission through useradmin is not possible, is there an alternative way to achieve this?

Appreciate any help/pointers on this.

-SKM

This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.

Best answer by Shashi_Mulugu

To guide you better, try not to use OOTB administrators group instead create your own client/project specific admin groups upon which you control permissions to each subtree and add people to it. Try to restrict to only add system admins to OOTB group for system maintenance.

H

Hamid1350

Adobe Employee

Can you verify if can do it via ACLs for individual path in crx/de ?

ArpitVarshney

Community Advisor

Hi @skmaem

I'm not sure but you can't change admin permission in AEM. If you try to do so, it will revert back to default again.

The role of admin to control and manage everything so restricting it for any action won't make any sense.

Regards,

Arpit Varshney

Shashi_Mulugu

Accepted solution

Community Advisor

To guide you better, try not to use OOTB administrators group instead create your own client/project specific admin groups upon which you control permissions to each subtree and add people to it. Try to restrict to only add system admins to OOTB group for system maintenance.

S

skmAemAuthor

Level 3

Thanks @shashi_mulugu,

We will follow this approach to create custom admin group and assign permissions accordingly.

Best Regards,

SKM

S

skmAemAuthor

Level 3

@hamid1350

When I denied the replicate permission through useradmin, i can see that the deny for crx:replicate action for administrators group in crxde access control tab. Pls see the screenshot. But it still allows a user in the administrators group to replicate assets.

@shashi_mulugu & @arpitvarshney , I agree that we should have followed the setup as you mentioned, but unfortunately I recently joined this project and they already have several power users added under administrators group for some reason. How do I work around it?

On this document: https://docs.adobe.com/content/help/en/experience-manager-64/administering/security/security.html they say you set "deny-everyone" on a node, administrators will have to be enabled explicitly to get them the access, what do they mean by "deny-everyone"? Pls see screenshot below:

Thanks everyone for your inputs!

-Shridev

H

Hamid1350

Adobe Employee

It's true .. it seems its not possible to achieve this via permission restrictions.

S

skmAemAuthor

Level 3

If it is not possible to prevent replication through permissions, is it possible to prevent it through touch ui/granite for everyone for a specific folder in dam? Any suggestions for this approach?

ArpitVarshney

Community Advisor

Hi @skmaem

I think it is not possible to change admin permission by anyway. Even though you will deny for everyone, admin can still access it because of its role in AEM.

Regards,

Arpit

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded