AEM could manager allows you to put users into a group, and to assign product profiles.
There are two product profiles per instance, AEM Administrators-xxx and AEM Users-xxx
In cloud manager, we can create groups, e.g:
- my-administrators
- my-authors.
we have 7 envs (prod, stage, uat, hot, dev, test etc). So 14 product profiles in total.
What we cant do in aem cloud is assign users to existing AEM groups, such as administrators or Authors (but it does let you assign DAM users, which, without the other groups, is useless).
So we have user A and user B
If we want to make user A administrator on dev, but Author on the rest, and we want to make user B be administrator on prod, but author on the rest, there is no sane way to do this.
What we did is put my-administrators in the administrator group on each local instance (not using the cloud console), and put my-authors in the Authors group.
This means if we put a user into the my-administrators group in the cloud console, it puts them in the administrators group when they login to that env.
In order for user to login to any env, he has to be assigned a product profile for that env. So we assign the Admin Users-xxx to all users who need to access environment xxx, but this does not control what role or permissions they are given (unfortunately), it only controls if they can login or not. The problem is, we cant make user A only admin on dev, he will become admin on prod also, because he can login to prod (but for a different role), and because the groups are synced to all envs.
We have tried many different ways to try to implement basic permissions, but so far have failed.
We are thinking one way might be to create every group we need (aka role), with a different name for every env.
E.g. my-administrators-dev, my-admininstators-prod etc. Then we go into each env, and put ONLY that envs groups into administrator.
To make it worse, you cant nest groups in AEM Cloud admin. So if we have a group with say 20 people in it (e.g. marketing), and we want to make them all say authors on an env, we have to manually put each person into say the my-authors-stage group, we can't just add marketing. If someone is hired in marketing, we have to manually assign them to each group one by one.
This is a nightmare to maintain - we will end up with hundreds of env specific groups, with manually configured local rights on each machine.
Howe do other people do this?
To make it worse, the groups UI on AEM instances is a disaster - search doesn't work (it only returns the first 5), you cant even order the list, and to search you have to scroll, and it loads one page at a time (very slowly) so you cant use the browsers page search (withouth first scrolling through all pages). Its unusable.
