Asset Link Share from AEM - Security and Configuration Questions

[BrettBirschbach]

Is it standard practice to allow public access to the AEM Author (/linkshare.html, /linksharepreview.html, /linkexpired.html) for asset link sharing?  I assume we would also need to open up paths like /etc.clientlibs and potentially others?

Once I've shared an asset, is there any way for me to recover the share URL or change the expiration?  I can see "Shared Links" in the DAM navigation, but clicking one only allows me to "Unshare" - I don't see an option to view/edit.

Is there any way to configure asset link share to omit renditions in the download?

[arunpatidar]

Hi,

Please check below:

Asset link sharing

Share assets as a link

If you want to share links from your AEM Author instance to external entities, ensure that you only expose the following URLs (which are specifically used for link sharing) for GET requests only:

• <AEM Server>/linkshare.html
• <AEM Server>/linksharepreview.html
• <AEM Server>/linkexpired.html

Block other URLs to ensure that your Author instance is secure.

To view the assets you shared as links, go to the Assets console and click/tap the GlobalNav icon. Choose Navigation from the list to display the Navigation pane.

From the Navigation pane, choose Link Shares to display a list of shared assets.

but you can't change the expiration?

[BrettBirschbach]

Hi Arun,

Yes, that link you provided is where I grabbed the list of pages I mentioned in my original post.  In testing, it appears other paths (e.g. /etc.clientlibs) must also be opened to the public.

My question was more generally asking if allowing public access to the author server for link shares is standard practice, since most author servers sit securely behind a firewall.

Regarding Link Shares, yes, the method of seeing active Link Shares that you mention is how I am viewing them in AEM.  However, I do not see any option to open an existing share to edit it.  Do you?

[Vish_dhaliwal]

Hello,

What exactly do you want to edit in that link?

One way is to edit from crx/de. Links are stored at path /var/dam/share. Otherwise, unshare the link and share it again after modifying the properties.

Regards,

Vishu

[BrettBirschbach]

I don't actually want to "edit" it per-say - I'd like to be able to retrieve the URL so that I can copy and paste it to someone in an email or instant message or something.  I realize the initial share executes an email, but after that point I dont see a way to get ahold of the link.

Also, it seems reasonable that someone would potentially want to extend the expiration of a share.

[Kunal_Gaba_]

You can update the expiration date by modifying the expirationDate property of the generated share nodes under - /var/dam/share folder. But I don't think there is a way to get the share URL as it is formed by creating a JWT token leveraging encryption.

[BrettBirschbach]

Ok, so the simple answers to my questions are...

- No it's not possible to get the link that was shared.

- No you cannot update the expiration of a shared link via the authoring interface (an admin can do it via CRX, but that's not practical for business use).

A bit disappointing, as both of these seem like they would be helpful and simple to implement.  These are the types of things that get me in trouble with clients when they use features like this that were advertised to them...

Anyway, I still have the following two questions from the original post:

- Is it standard practice to allow public access to the AEM Author (limited to required paths) for asset link sharing?

- Is there any way to configure asset link share to omit renditions in the download?

[Gaurav-Behl]

- Is it standard practice to allow public access to the AEM Author (limited to required paths) for asset link sharing?

     -- I don't think so but this is the direction provided by Adobe docs.

- Is there any way to configure asset link share to omit renditions in the download?

     -- I haven't gone through the code but I believe this feature "Allow download of Original file" might help. Otherwise, it should be feasible through customization

Path for shared links: /var/dam/share/ ..... 

You may be able to find more clues at http://localhost:4502/system/console/events 

4/4/2019, 10:59:49 AM

org/apache/sling/api/resource/Resource/CHANGED

path /var/dam/share/36aa75a3_e13d_449f_b5a8_f8e45c0e6457 event.topics org/apache/sling/api/resource/Resource/CHANGED userid assetlinkshareservice resourceType nt:unstructured

Even if it doesn't capture the shared link OOB, you could always customize it and add a logger or save it in the node itself as a property under /var/dam/share

[BrettBirschbach]

Yes, I understand the direction from Adobe, but it seems like an overall bad idea to allow outside world access to the Author which is why Im asking the community if this is "truly" what should be done to enable Asset link Sharing for a client.  If not, then to some extent we're selling vaporware.

The checkbox to include original asset simply updates the download of renditions to *also* include the original - I dont see any option to remove the renditions (which in some cases could be very significant in size and also in some cases might not be desireable to be shared by the client.  Understood that I could customize AEM to do this, but again now I've lost the leverage of an OOTB feature that I can promote to the client because I have to also include development resources to make this feature truly user-friendly to business stakeholders.

[KBWEB · Accepted solution]

Hi Brett.Birschbach​ - I am having the same problem with asset link sharing outside of the company firewall(s). I definitely don't want jeopardize the security of the author instance by opening it to the Internet. to  I am exploring an options to publish assets to one of the "publish" instance(s) living in the DMZ, and have an internal user role that can generate the assets share link from that same instance. of course replicating of that link to other publish instances will not work, which makes the solution not scalable at this point.

Hope to hear more ideas from the community. 

My client also is looking to share only certain renditions, but there is no such an option as you noted. We will be developing custom solution for this, but it would have been nice if Adobe includes it in the OOTB solution.

[BrettBirschbach]

Thanks for the confirmation KBWEB​.  This kinda of stuff makes me angry, because the features give an impression that clients can do a certain thing with the platform, but in reality (due to normal, practical reasons) they cannot.  These features have been around long enough that they should be more fully functional than they currently are, and I think it's sad that your team is going to have to build a custom solution, spending the client's money doing so.  Not your fault - Adobe should have these things supported in the OOTB solution.

[Schripts]

Hey Brett.Birschbach​ - As a client, this is also extremely frustrating since this was definitely marketed to us as a great feature by Adobe, but the practical reality is we're having to revert to downloading assets from AEM, saving them to Dropbox, and then sending a Dropbox link to external vendors since getting 12 renditions x 10 shared assets means that our partners have to sort through 120 images to get the 10 correct ones. Completely unacceptable, and shocking that Adobe's response seems to be "Eh. Customize it."

[karthikreddii]

Hi KBWEB​,

My client also is looking to share only certain renditions, but there is no such an option as you noted. We will be developing custom solution for this, but it would have been nice if Adobe includes it in the OOTB solution.

Were you able to fix this?? Could you point me to the location where the code needs to be updated for this feature