Hi @dhinuba ,
RECOMMENDED METHOD
Use JWT or OAuth authentication with AEM Publish, combined with Dispatcher filtering and Sling Authentication.
1. Enable Token Authentication on Publish
Use AEM’s Adobe IMS Authentication Handler or Custom JWT/OAuth Token Validator.
Example with JWT-based OAuth:
Configure your JWT Issuer (like Adobe I/O, Auth0, etc.)
Use an Authentication Servlet Filter to validate tokens
Return 401 Unauthorized for invalid tokens
2. Secure the Dispatcher Layer
In your dispatcher/src/conf.dispatcher.d/filters/filters.any, restrict API paths:
/0091 { /type "deny" /url "/content/dam.*" }
/0092 { /type "allow" /url "/api.*" }
Ensure only authorized endpoints are allowed.
3. Set Up CUGs (Closed User Groups) (Optional)
For protecting certain paths:
Create a group with read access
Use CUGs on the Publish instance
Add the group to the CUG on /content/dam or wherever CFs are
4. Use Token-Based Access from Consumers (SPAs, APIs)
Every client consuming the API:
Requests a token (OAuth2, JWT)
Passes it via Authorization: Bearer <token> header
Your custom AEM servlet or filter checks token validity.
Regards,
Amit
