Console Error - Principle-Based Access Control Setup | Community
Skip to main content
Rohan_Garg
Community Advisor
Rohan_GargCommunity Advisor
Community Advisor
November 28, 2022
Solved

Console Error - Principle-Based Access Control Setup

  • November 28, 2022
  • 2 replies
  • 1637 views

Hi All,

 

I have an issue with the below warning log -

25.11.2022 01:32:19.770 [cm-pxyzabc-eabcxyz-aem-publish-zzzz68f69-hp6ff] *WARN* [20.59.3.67 [1669339939629] GET /content/brandA/us/en/home.html HTTP/1.1] com.adobe.granite.repository.impl.SystemPrincipalsValidation Refactor principal 'custom-system-user' to have principal-based access control setup.

 

The system user is defined in the JSON file (.cfg.json) as below -

 

The permissions for the system user (ACE and User) are picked from yml file defined as below -

 

How should I refactor the service user and mapping to use principle name and principle-based authorization ?

 

@arunpatidar, @markusbullaadobe, @b_sravan, @kautuk_sahni 

 

Thanks,

Rohan Garg

    This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.
    Best answer by Rohan_Garg

    As per sling documentation (https://sling.apache.org/documentation/the-sling-engine/service-authentication.html) -

     

    The below is the principle based mapping which is what we are already using -

    <service-name>[:<subservice-name>]="["<principal name of a JCR system user>{","<principal name of a JCR system user>}"]"

     

    2 replies

    Rohan_Garg
    Community Advisor
    Rohan_GargCommunity AdvisorAuthorAccepted solution
    Community Advisor
    November 28, 2022

    As per sling documentation (https://sling.apache.org/documentation/the-sling-engine/service-authentication.html) -

     

    The below is the principle based mapping which is what we are already using -

    <service-name>[:<subservice-name>]="["<principal name of a JCR system user>{","<principal name of a JCR system user>}"]"

     

      arunpatidar
      Community Advisor
      arunpatidarCommunity Advisor
      Community Advisor
      November 28, 2022

      Can you try to setup user with name as well?

      Example

         - al-oneweb-service-write-user:
       - isMemberOf:
         isSystemUser: true
         name: al-oneweb-service-write-user 
         path: /home/users/system/aemlab/oneweb
      Arun Patidar
        Rohan_Garg
        Community Advisor
        Rohan_GargCommunity AdvisorAuthor
        Community Advisor
        November 28, 2022

        @arunpatidar - Thanks for the quick reply, unfortunately still getting the same result!

        Also one observation, the issue is seen only on our STAGE environment and not DEV environment.

        The console warning related to this service user is not there on DEV.

        Both the environments are using the same version of AEM - 2022.9.8722.20220912T101352Z

         
        AEM RELEASE: 2022.9.8722.20220912T101352Z
        		  
          arunpatidar
          Community Advisor
          arunpatidarCommunity Advisor
          Community Advisor
          November 28, 2022

          did you deploy the changes in STAGE?

          or the observation without the changes?

           

          check this also https://github.com/Netcentric/accesscontroltool/issues/563 

          Arun Patidar
            Terms & ConditionsAccessibility statement

            Loading footer...