ACLs on author defective after AEM6.1 migration

[alexanderw22637]

Hi everybody,

maybe someone can help me with this issue...We recently performed the AEM 6.1 migration from a CQ5.5 instance and could observe, that our ACLs are not working anymore for users with restricted access to /content.

Within the /useradmin.html i can see that those users can read "/" and can read "/content" and all the necessary subfolders like they did in CQ5.5. These users are in a group where the ACL for e.g. "/" looks like:

    <allow0
        jcr:primaryType="rep:GrantACE"
        rep:principalName="base_group"
        rep:privileges="{Name}[jcr:read]">
        <rep:restrictions
            jcr:primaryType="rep:Restrictions"
            rep:glob=""/>
    </allow0>

But in the /siteadmin view those users cannot se anything (no tree and no content). Even the "Websites" Folder cannot be displayed in a correct manner.

Did you observe the same issues or can you help me to solve this?

Greetings Alex

[kautuk_sahni]

Hi 

There is a document telling tips and troubleshooting after upgrading AEM.

Pleas have a look at it:-

PAGES INCOMPLETELY LOADED DUE TO ACL CHANGES

5.2.1, 5.3, 5.4

Problem: After the upgrade of site, pages are only partly loaded or look broken when accessed over the publish server.

Solution: By default, AEM now prevents read access for anonymous users to certain locations in the repository on a publish server. If the site requests resources in these locations, they will not be loaded and result in a 404 error. We recommend moving these resources to publicly available locations in the repository.

An anonymous web site visitor has no access to following paths in AEM 5.6 or later:

• /apps
• /libs
• /home

It is recommended to place publicly accessible resources in:

• /content
• /etc/designs

Link:- https://docs.adobe.com/docs/en/cq/5-6-1/deploying/upgrading/tips-and-troubleshooting.html

I hope this would help you.

Thanks and Regards

Kautuk Sahni

[alexanderw22637]

Hi Kautuk,

thanks for your answer, but this is not quite our issue here.