Hide "reports" tile under "Assets" inside "Tools"

[aem_noob]

hi all,

I'm exploring for the best possible way to restrict access for Tools - Assets - Reports tile/icon in my author envrionment.

I want to restrict this tile to only certain groups in my author environment.

I also want to restrict href to which it connects such as /mnt/overlay/dam/gui/content/reports/reportlist.html

what is the best way to do so?

one way I checked was render condition -

<groupPermission

jcr:primaryType="nt:unstructured"

sling:resourceType="cq/gui/components/siteadmin/admin/listview/columns/grouprendercondition"

groups="[DEV Author, Stage Author, Prod Author]"/>

thanks in advance

[aanchal-sikka · Accepted solution]

Hello @aem_noob 

Please try by revoking the read permission for the groups on:

- /libs/dam/gui/content/nav/tools/assets/assetreports

- /libs/dam/gui/content/reports/reportlist

[aem_noob]

that's definitely neater for tools icon as well! thanks

[aem_noob]

@aanchal-sikka- Though the icon is showing and hiding successfully, I still have an issue with actually generating the reports.

As per https://experienceleague.adobe.com/docs/experience-manager-assets-essentials/help/manage-reports.htm...

All users who are assigned to the Assets Essentials Administrators product profile can access the Insights dashboard or create user-defined reports in Assets Essentials.

Is there a way we can assign custom permissions to a group (with user product profile) to generate reports?

Getting below error currently for non-admin role -
30.10.2023 11:08:10.274 *INFO* [127.0.0.1 [1698493638131] POST /libs/dam/gui/content/reports/generatereport.export.json HTTP/1.1] com.day.cq.dam.core.impl.servlet.GenerateReportServlet Failed to create job to generate report titled 1212
30.10.2023 11:08:10.274 *ERROR* [127.0.0.1 [1698644289965] POST /libs/dam/gui/content/reports/generatereport.export.json HTTP/1.1]
30.10.2023 11:08:10.274 *ERROR* [127.0.0.1 [1698644289965] POST /libs/dam/gui/content/reports/generatereport.export.json HTTP/1.1] org.apache.sling.engine.impl.SlingRequestProcessorImpl service: Uncaught Throwable
javax.servlet.ServletException: javax.jcr.AccessDeniedException: Access denied.
at com.day.cq.dam.core.impl.servlet.GenerateReportServlet.doPost(GenerateReportServlet.java:175) [com.day.cq.dam.cq-dam-core:5.15.26]
at org.apache.sling.api.servlets.SlingAllMethodsServlet.mayService(SlingAllMethodsServlet.java:146) [org.apache.sling.api:2.27.2]
at org.apache.sling.api.servlets.SlingSafeMethodsServlet.service(SlingSafeMethodsServlet.java:342) [org.apache.sling.api:2.27.2]
Caused by: javax.jcr.AccessDeniedException: Access denied.
at org.apache.jackrabbit.oak.jcr.security.AccessManager.checkPermissions(AccessManager.java:71) [org.apache.jackrabbit.oak-jcr:1.52.0.T20230629133256-25c01b8]

For Admin Role -
30.10.2023 11:45:27.996 *INFO* [sling-oak-observation-14] org.apache.sling.event.impl.jobs.queues.JobQueueImpl.Async Operation Default Queue Config Starting job queue Async Operation Default Queue Config
30.10.2023 11:45:28.001 *INFO* [FelixLogListener] Events.Service.org.apache.sling.event Service [QueueMBean for queue Async Operation Default Queue Config,6669, [org.apache.sling.event.jobs.jmx.StatisticsMBean]] ServiceEvent REGISTERED
30.10.2023 11:45:28.022 *INFO* [sling-threadpool-64e20f1c-5ee0-4b5c-8d9d-4e074fe9221b-(apache-sling-job-thread-pool)-1-Async Operation Default Queue Config(com/adobe/cq/dam/report)] com.day.cq.dam.core.impl.reports.ReportJobConsumer Started processing job request for report titled 1212.
30.10.2023 11:45:28.044 *INFO* [sling-threadpool-64e20f1c-5ee0-4b5c-8d9d-4e074fe9221b-(apache-sling-job-thread-pool)-1-Async Operation Default Queue Config(com/adobe/cq/dam/report)] com.day.cq.dam.core.impl.reports.ReportJobConsumer Report titled 1212 successfully created.
30.10.2023 11:45:28.060 *WARN* [sling-threadpool-64e20f1c-5ee0-4b5c-8d9d-4e074fe9221b-(apache-sling-job-thread-pool)-1-Async Operation Default Queue Config(com/adobe/cq/dam/report)] com.adobe.granite.jobs.async.notification.email.AsyncJobEmail Can't get email address for user admin
30.10.2023 11:45:28.062 *WARN* [sling-threadpool-64e20f1c-5ee0-4b5c-8d9d-4e074fe9221b-(apache-sling-job-thread-pool)-1-Async Operation Default Queue Config(com/adobe/cq/dam/report)] com.adobe.granite.jobs.async.notification.email.AsyncJobEmail Can't get email address for user admin
30.10.2023 11:45:28.062 *ERROR* [sling-threadpool-64e20f1c-5ee0-4b5c-8d9d-4e074fe9221b-(apache-sling-job-thread-pool)-1-Async Operation Default Queue Config(com/adobe/cq/dam/report)] com.day.cq.dam.core.impl.jobs.AsyncJobNotificationServiceImpl Can't send email notification. No recipients.
30.10.2023 11:45:30.015 *INFO* [CommitStats] CommitStats 14 commits by 4 users [64% sling-event, 14% dam-reports-manager-service, 14% admin, 7% taskmanagement-service] from 2 locations [57% other:java.base/java.lang.Thread.run(Thread.java:834), 42% HTTP-POST:/libs/dam/gui/content/reports/generatereport.e...] [CommitStats overhead was 0ms = 0.0us / commit]

[aanchal-sikka]

Hello @aem_noob 

Please refer to "ACLs required to enable Reports" on https://techrevel.blog/2019/10/13/aem-asset-reports/#acls-asset-reports

[Rohan_Garg]

@aem_noob - Add rep:write to /var (particularly /var/dam/reports)
From your other question's YAML I can see you have assigned jcr:read on /var