Closed User Group (CUG) not working as expected and allowing all users to login | Community
Skip to main content
chintan97patel
chintan97patel
Level 2
January 19, 2021
Solved

Closed User Group (CUG) not working as expected and allowing all users to login

  • January 19, 2021
  • 3 replies
  • 2301 views
 
 

I am testing out Closed User Group (CUG). I followed basic steps for adding CUG for a page (https://experienceleague.adobe.com/docs/experience-manager-64/administering/security/cug.html#security). After following the steps, it adds restrictions to the page and requires login to the page as expected. However, it allows every valid users to login in the page. 

 

To elaborate, if I have group G1 having user U1 part of group and add G1 under Closed User Group from page properties, it should only allow U1 to login to the restricted page. However, it allows other users (U2, U3 for example) as well to access CUG restricted page which is not an expected scenario. To summarize, it allows all valid users to login to the CUG restricted page. To add, I am testing from publisher side, so no dispatcher changes would come into affect here. 

This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.
Best answer by chintan97patel

Adding my update for the issue for someone who visits this.

So, CUG will allow the users (U2, U3) to login and will not send error response for "authentication". And it will set the login-token cookie. However, since the user is not authorized to view the content for the page, it will show up 404 page. In your case, if you have setup a default 404 page, it will show up content from that page after setting the login-token cookie. Now since the default 404 page content might be part of /apps/<your-site>, you will need to give read permission (to U2 and U3, make sure you don't mess up ACLs on publishers) to that path as well (pretty much the issue I had where the 404 page content was not being rendered properly). 

To summarize, even if the user is not "authorized" to view the content since it is not part of group G1, it will set the login-token cookie but render 404 page. If the user is part of group G1, it will show up the content of the page. I had all the required permissions set from /content/ but read permission under /apps/<site> were missing which is holding some default designs.

3 replies

Vijayalakshmi_S
Vijayalakshmi_S
Level 10
January 20, 2021

Hi @chintan97patel,

Could you please share the level of permissions for U2 and U3 and its groups, if any associated to the same.

Also, just as an additional check, cross check the CUG group and its users/permissions from being in Publish instance. 

 

    arunpatidar
    Community Advisor
    arunpatidarCommunity Advisor
    Community Advisor
    January 21, 2021

    Hi,

    Can you please confirm:

    • Page has only one group(G1), you can varify from crxde as wll the principals stored in rep:cugPolicy node
    • User U2 and U3 does not have any group(or at least Group G1)
    • anonymous user can't access the protected page as well
    Arun Patidar
      chintan97patel
      chintan97patelAuthorAccepted solution
      Level 2
      February 15, 2021

      Adding my update for the issue for someone who visits this.

      So, CUG will allow the users (U2, U3) to login and will not send error response for "authentication". And it will set the login-token cookie. However, since the user is not authorized to view the content for the page, it will show up 404 page. In your case, if you have setup a default 404 page, it will show up content from that page after setting the login-token cookie. Now since the default 404 page content might be part of /apps/<your-site>, you will need to give read permission (to U2 and U3, make sure you don't mess up ACLs on publishers) to that path as well (pretty much the issue I had where the 404 page content was not being rendered properly). 

      To summarize, even if the user is not "authorized" to view the content since it is not part of group G1, it will set the login-token cookie but render 404 page. If the user is part of group G1, it will show up the content of the page. I had all the required permissions set from /content/ but read permission under /apps/<site> were missing which is holding some default designs.

        Terms & ConditionsAccessibility statement

        Loading footer...