AEM Bundle Whitelisting | Community
Skip to main content
Jai1122
Jai1122
Level 4
February 11, 2021
Solved

AEM Bundle Whitelisting

  • February 11, 2021
  • 2 replies
  • 1331 views

Hi Experts,

  We are using AEM 6.4.5 and working on a custom authentication handler. Eventually the handler will invoke TokenUtil, something like.

TokenUtil.createCredentials(request, response, this.repository, userId, true);

Internally TokenUtil does the following,

repository.loginAdministrative((String)null);

 Meaning we need to whitelist the bundle.  However, Adobe has recommended that whitelisting is not a good idea and definitely  not advisable for production instances. I could see this question already asked for AEM6_3

 

I am not really certain if I should do the whitelisting or what is the way forward. Kindly advise.

 

Regards,

Jai

 

This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.
Best answer by Umesh_Thakur

There were always a flaw in the design that was getting Admin session and using and it was also violating the principle of least privileges that is why adobe is recommending not to use admin session and not to whitelist the bundle that is using admin session from SlingRepository.loginAdministrative().

so Solution of this is only to go with Service User approach.

Details can be found here https://experienceleague.adobe.com/docs/experience-manager-64/administering/security/security-service-users.html?lang=en#security

 

but still if you what to whitelist the bundle you can do with Apache Sling Login Admin whitelist config from config manager.

 

Hope this will help.

Umesh Thakur

 

2 replies

Umesh_Thakur
Community Advisor
Umesh_ThakurCommunity AdvisorAccepted solution
Community Advisor
February 12, 2021

There were always a flaw in the design that was getting Admin session and using and it was also violating the principle of least privileges that is why adobe is recommending not to use admin session and not to whitelist the bundle that is using admin session from SlingRepository.loginAdministrative().

so Solution of this is only to go with Service User approach.

Details can be found here https://experienceleague.adobe.com/docs/experience-manager-64/administering/security/security-service-users.html?lang=en#security

 

but still if you what to whitelist the bundle you can do with Apache Sling Login Admin whitelist config from config manager.

 

Hope this will help.

Umesh Thakur

 

    joerghoh
    Adobe Employee
    joerghohAdobe Employee
    Adobe Employee
    February 12, 2021

    If that method is doing it internally, whitelist your application bundle. There is no other way to do it, except you avoid creating that method.

      Terms & ConditionsAccessibility statement

      Loading footer...