Authorization Framework for my AEM Site | Community
Skip to main content
P
patK-ze1xYs
Level 4
February 27, 2024
Solved

Authorization Framework for my AEM Site

  • February 27, 2024
  • 2 replies
  • 1732 views

I am working on a new AEM site, as part of the architecture I want to perform authorization checks for my user, e.g. if user is allowed to click on a CTA etc, is user allowed to read dynamic field value etc. 
My users will be coming from an external CIAM/IDP provider. 

Does AEM provide any documentation, references, or OOTB integration with the Authorization Framework? Like Zanzibar, Auth0 FGA etc? 

This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.
Best answer by joerghoh

That's my challenge my Object repository is already defined externally and I am trying to integrate my content with it.
Also this approach would work for a standard role but may face scalability issues:
Check if a user is allowed to redeem a coupon if
1- He/She belongs to the silver tier
2- He/She can redeem a coupon if the coupon is for products A,B, C but not D
3- As a silver tier member allow redeem action for subscriber members only

It becomes challenging to create this sort of authorization data model. Please let me know if I am. missing anything 

 


While the requirements 1 and 3 could be implemented by permissions on a certain operation object in the repository, (2) is much harder to implement.

 

I could imagine that /content/actions/redeem-a-coupon/product-A could be done and then you would additional permissions on the product-A resource; but I am not sure if this approach scales to your requirements (for example if you have 1000s of products) and also if you have more AND or OR relations with other constraints.

 

But I think that's the point where you need to think about about a different way to represent your logic. And then maybe the AEM-native capabilities are not a good match anymore.

2 replies

Imran__Khan
Community Advisor
Imran__KhanCommunity Advisor
Community Advisor
February 27, 2024

@patk-ze1xys You can use ACL's to provide view and button related access depending on the permissions assigned to user.

Please find below link for reference:

https://experienceleague.adobe.com/docs/experience-manager-65/content/security/security.html?lang=en#:~:text=AEM%20WCM%20uses%20Access%20Control,which%20these%20permissions%20are%20applied.

https://experienceleague.adobe.com/docs/experience-manager-screens/user-guide/administering/setting-up-acls.html?lang=en

    P
    patK-ze1xYsAuthor
    Level 4
    February 28, 2024

    I am looking beyond these roles, where users's context and what users can do within the application. Built-in user/groups work well but have their limitations. Hence we are looking for more scalable and in-depth authorization options. 

    There are multiple authorization frameworks in the market, but couldn't find an example of how to implement them. 

    E.g. in a headless CMS,  I want to put authorization layer before user's action reaches to an API


      joerghoh
      Adobe Employee
      joerghohAdobe Employee
      Adobe Employee
      February 28, 2024

      The underlying repository is quite flexible, and also the authorization mechanism is extensible (although rarely done). But the authorization is implemented on the repository level; that means if you have read access to a resource, you can read it for whatever purpose you need to access it. That means, you can read this resource you cannot restrict that this read can only be done for download and not for a copy and paste action to a location where you have write access to.

       

      So can you please provide a few examples for activities, which you want to authorize separately?

       

        kautuk_sahni
        Community Manager
        kautuk_sahniCommunity Manager
        Community Manager
        February 28, 2024

        @patk-ze1xys Did you find the suggestions from users helpful? Please let us know if more information is required. Otherwise, please mark the answer as correct for posterity. If you have found out solution yourself, please share it with the community.

        Kautuk Sahni
        P
        patK-ze1xYsAuthor
        Level 4
        February 28, 2024


        Still looking........

          Terms & ConditionsAccessibility statement

          Loading footer...