[Actions Center] Deprecated Service User Mapping Detected

[ViaVu]

Hi, To resolve "Deprecated Service User Mapping Detected", I created the following file under the osgiconf of the ui.config

"org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended.cfg.json"

Following are its sample content. 

{

   "user.mapping": [

        "com.adobe.acs.acs-aem-commons-bundle:twitter-updater=[serviceuser--com.adobe.acs.acs-aem-commons-bundle--twitter-updater]",

         "aem-precompiled-scripts:scene7-asset-reader-service=[serviceuser--aem-precompiled-scripts--scene7-asset-reader-service]"

     ]

}

Does it look good to resolve the "Deprecated Service User Mapping Detected"? Or is there anything more to do?

[SantoshSai]

Hi @ViaVu,

This looks good to me, except for one thing - the OSGi configuration filename you're using:

org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended.cfg.json

To avoid the “Deprecated Service User Mapping Detected” warning and ensure the mapping is correctly registered, the filename should follow the pattern:

org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~<name>.cfg.json

For example:

org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~acs-commons.cfg.json

The ~<name> suffix is required to properly register the mapping as a named amendment configuration.

Other than that, your JSON structure and mappings look absolutely fine. Just make this filename adjustment, and you should be all set!

Also, worth to refer below articles since you just have posted sample code than actual code.

• https://medium.com/%40bsaravanaprakash/aem-how-to-fix-system-users-warning-8890a3f69122
• https://www.oshyn.com/blog/aem-user-mappings-enforcing-cybersecurity

[ViaVu]

Hi @SantoshSai, thank you for your quick response. 

If I append the ~<name> suffix like the following...

org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~acsaemcommons.cfg.json

I can see the file from CRX/DE interface. However, the same is not visible from the Server Config console. 

If I name it as below...

org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended.cfg.json

I can see it in both CRX/DE and also from Server Config.console

The screenshot looks as seen below. Does this look correct and do you think this will help resolve the "Deprecated Service User Mapping" issue reported by AEM Cloud Services?

[SantoshSai]

@ViaVu 

The user name must be enclosed in double quotes inside square brackets:

"user.mapping": [
"com.adobe.acs.acs-aem-commons-bundle:workflowpackagemanager-service=[\"serviceuser--com.adobe.acs.acs-aem-commons-bundle--workflowpackagemanager-service\"]",
"com.adobe.acs.acs-aem-commons-bundle:twitter-updater=[\"serviceuser--com.adobe.acs.acs-aem-commons-bundle--twitter-updater\"]",
"aem-precompiled-scripts:scene7-asset-reader-service=[\"serviceuser--aem-precompiled-scripts--scene7-asset-reader-service\"]",
"com.adobe.acs.acs-aem-commons-bundle:package-replication-status-event-listener=[\"serviceuser--com.adobe.acs.acs-aem-commons-bundle--package-replication-status-event-listener\"]"
]

[ViaVu]

@SantoshSai I tried your suggestion. Now it looks like the following...

Can you suggest steps to validate this configuration on my local before this gets deployed to AEMaaCS environment? 

[EstebanBustamante]

Hi,

The warning typically appears when an outdated pattern is used to create user mappings (the username was not enclosed in brackets). Your current configuration looks correct. For more details, please refer to the documentation here:
https://experienceleague.adobe.com/en/docs/experience-manager-cloud-service/content/security/best-pr...

Hope this helps!

[ViaVu]

Hi @EstebanBustamante 

Thanks for reviewing the configuration posted. 

I did refer to the URL you have posted. The following suggested sample mapping provided in the document does not seem to be json compliant. I was not sure how to proceed with this approach and was not sure if this is applicable to the latest AEMaaCS environment.

org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended-my-mapping
user.default=""
user.mapping=[
"com.adobe.cq.my-bundle:my-subservice\=[content-writer-service]",
"com.adobe.cq.my-bundle:my-subservice-different-task\="[myfeature-configuration-writer-service,content-reader-service]"
]

[kautuk_sahni]

@ViaVu just checking in! Were you able to get this resolved? If one of the replies above helped—whether it completely solved the issue or simply pointed you in the right direction—marking it as accepted can make it much easier for others with the same question to find a solution. And if you found a different way to fix it, sharing your approach would be a great contribution to the community. Your follow-up not only helps close the loop but also ensures others benefit from your experience. Thanks so much for being part of the conversation!

[ViaVu]

Hi @kautuk_sahni No, this has not been resolved yet. The changes I tried as suggested did not work so far. As it appears, the issue is only reported for production and anything I try can be tested only on production. So, it is a slow process. If you have any suggestions to recreate the issue on lower environment and also any suggestions to resolve, that would be greatly appreciated. Thank you!