AEMaaCS - IMS Groups and Users - Same Product Profile | Community
Skip to main content
Rohan_Garg
Community Advisor
Rohan_GargCommunity Advisor
Community Advisor
June 15, 2023
Solved

AEMaaCS - IMS Groups and Users - Same Product Profile

  • June 15, 2023
  • 3 replies
  • 1673 views

Hi AEM Community,

 

I am a little confused in IMS Users and IMS Groups w.r.t IMS Product Profiles.

 

Scenario -

I have added an IMS User to AEM Users Product Profile.

This IMS User is also assigned to an IMS Group.

 

As per Adobe IMS User Groups Video (https://experienceleague.adobe.com/docs/experience-manager-learn/cloud-service/accessing/adobe-ims-user-groups.html?lang=en)

IMS User Groups cannot be assigned to AEM Product Profiles.

 

However, I was able to assign AEM Users Product Profile to the IMS Group without getting any error/warning displayed.

(Ideally this should be blocked or some warning message should be displayed!)

 

This poses the below query -

If I go ahead and remove the AEM Users Product Profile for the IMS User without removing it for the IMS Group.

Will the IMS User be able to access the AEM instance?

@arunpatidar, @kautuk_sahni, @himanshu_jain , @jagadeesh_prakash 

 

Thanks,

Rohan Garg

This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.
Best answer by Rohan_Garg

Hi All, 

 

Thank you for your responses! Here's the explanation I think is valid - 

1. From Product Profiles Console, you can add IMS Users but not IMS Groups.

2. From IMS Users & Groups console, you can only assign/remove groups & products. You cannot assign/remove product profiles.

 

There is a clear separation of concern here.

If User A has access to Instance 1's AEM Administrators profile & If User A is part of Group X which has been further assigned Instance 1's AEM Users profile then both will run in parallel.

If we see User A's profiles under the instance - we will see 2 Product profiles - 1 Administrators profile and the other 1 AEM Users profile (sub texted by Assigned By X User Group)

3 replies

ManviSharma
Adobe Employee
ManviSharmaAdobe Employee
Adobe Employee
June 15, 2023

Hi,

 

To address the confusion and ensure proper user access management I would  recommend following these steps:

  1. Remove the assignment of the AEM Users Product Profile from the IMS Group that you had assigned it to.

  2. Assign the AEM Users Product Profile directly to individual IMS Users instead of IMS Groups. This ensures better control and granularity over user access rights.

  3. Review and adjust the permissions and access configurations for both the IMS Users and IMS Groups to align with your desired access requirements.

  4. If necessary, create separate IMS Groups for specific access roles or permissions within AEM, and assign the relevant AEM Product Profiles to those IMS Groups.

By following to these steps, you can ensure that user access in AEM is properly managed, avoiding any conflicts or unexpected behaviors.

    Rohan_Garg
    Community Advisor
    Rohan_GargCommunity AdvisorAuthor
    Community Advisor
    June 16, 2023

    Thank you for your reply @manvisharma! I have few queries on this - 

    For Point 2 - Usually in AEM, we give permissions on group rather than individual user. Shouldn't the same principle apply on IMS?

    For Point 4 - The IMS User Groups should be product agnostic ideally, reusable across multiple experience products. Won't creating separate IMS groups w.r.t AEM roles deviate from this practice?

      Himanshu_Jain
      Community Advisor
      Himanshu_JainCommunity Advisor
      Community Advisor
      June 16, 2023

      Hi Rohan,

      Following below my observations regarding the scenario you mentioned.

      1.Every user group is assigned to one of the product profile . As soon you assign the user to that group user will be able to access that product .

      Also you cannot remove that product profile from the user if user is assigned to that group , checkbox will be disabled.

       

      For ex: You have a dev-author group and you assigned dev-author-general-user product profile as every AEM product consist 2 profiles general user & admin. As soon you added this group to the user this product profile will be available by default to the user and you cannot remove it until you removed the user from that group.

       

      Thanks

       

       

       

       

      Himanshu Jain
        Rohan_Garg
        Community Advisor
        Rohan_GargCommunity AdvisorAuthor
        Community Advisor
        June 16, 2023

        @himanshu_jain - Thanks for the response.

         

        For Point 1 - Every user group is assigned to one of the product profile.

        I read the below note saying currently you cannot assign groups to product profiles.

        This however does not seem to be true then. Correct?
        If I am able to assign product profiles to groups then assigning groups to product profiles should also be similar.

        I understand that similar to AEM, The user should not be given permission individually but rather as part of the group. But the note above caused this confusion in my understanding.

          Rohan_Garg
          Community Advisor
          Rohan_GargCommunity AdvisorAuthorAccepted solution
          Community Advisor
          June 19, 2023

          Hi All, 

           

          Thank you for your responses! Here's the explanation I think is valid - 

          1. From Product Profiles Console, you can add IMS Users but not IMS Groups.

          2. From IMS Users & Groups console, you can only assign/remove groups & products. You cannot assign/remove product profiles.

           

          There is a clear separation of concern here.

          If User A has access to Instance 1's AEM Administrators profile & If User A is part of Group X which has been further assigned Instance 1's AEM Users profile then both will run in parallel.

          If we see User A's profiles under the instance - we will see 2 Product profiles - 1 Administrators profile and the other 1 AEM Users profile (sub texted by Assigned By X User Group)

          Terms & ConditionsAccessibility statement

          Loading footer...