Best way to implement site that must be logged in with selective access?

[#1]

I am working on implementing an internal site built on AEM 6.3.

I have a business requirement to make the site require the user to be logged in with an employee user group attached to their profile. I looked at implementing this by making all pages have the employee closed user group configured by default, so that they cannot be accessed without it. However, there are other pages within the site that have other closed user groups that are required to access the page, if they have the employee group, this allows the user to access the page even if they do not have the other groups.

So, what would be the best way to restrict access to the entire site, while still requiring specific groups on pages within the site?

[#2]

As you mentioned - you need to make user of CUG and a login component for the pages you want to secure.

We have an example article that shows how to write a login component for the entire site.

Creating a Login Component for the Experience Manager Weekend Site

In this example - the site created by the WKND tutorial is used as an example.

"However, there are other pages within the site that have other closed user groups that are required to access the page, if they have the employee group, this allows the user to access the page even if they do not have the other groups."

I am not aware of restricting users whom logged into the site from gaining access to other pages.  Are you referring to having users log into the general site and then authenticating again for more pages?

[#3]

I have created a login component per the tutorial, and I have the site set up to require a login.

What I am trying to find a way to do now is to restrict users from accesssing other pages based on the groups that they have within AEM.

For example, a logged in user may be part of the 'Sales' group, so they should be able to access pages that are restricted to members of the 'Sales' group. That same user may not be a member of the 'Marketing' group, so I would not want them to be able to see/access pages that require the 'Marketing' group.

[#4]

The best way is  ACL to restrict the access for users, go to <servername>:4502/useradmin page and create two groups as "Sales" & "Marketing" and define  ACL policies and add the respective user to those group.

For More details User Administration and Security

Thanks!