Managing permissions on DAM | Community
Skip to main content
S
santhiswaroopg
April 6, 2021
Solved

Managing permissions on DAM

  • April 6, 2021
  • 2 replies
  • 3363 views

What is the recommended way to manage permissions on DAM folders?

 

I see that users can create private folders in DAM and can assign users/groups from the permissions of the folder. Is this a good option to go with.

 

I understand that permissions should be pre defined by dev teams with inputs from business on folders and only admin can set them at a group level from user admin console.

 

Would there be any issues with governance when we give users free hand to assign users to folders.

This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.
Best answer by MarkusBullaAdobe

When it comes to permission management there are two separate areas to look at:

 

  1. General permission setup for all users, groups and tenants/markets/etc.
    This should be a predefined hierarchy that is designed by your project-specific authorization matrix, implemented by your development team and rolled-out through your regular deployment process to create groups and assign ACLs. I recommend to leverage the Netcentric ACL Tool [1] for this.
  2. The "Private Folder" feature auf AEM Assets
    This is a different use case where regular AEM users (content authors) can create protected folders and authorize other users to access these private folders. See [2] for a documentation of this feature. In this case AEM will take care of creating groups and setting permissions on a lower (CRX) level when the content author adds users for collaboration to his private folder. AEM will also delete the according groups once access is revoked or the folder is deleted.

While 1 is the basis for your projects overall authorization concept, 2 is a collaboration feature of AEM Assets that sits on top of 1.

 

[1] https://github.com/Netcentric/accesscontroltool

[2] https://experienceleague.adobe.com/docs/experience-manager-65/assets/managing/private-folder.html

2 replies

arunpatidar
Community Advisor
arunpatidarCommunity Advisor
Community Advisor
April 6, 2021

Yes, permission should be defined by business based on taxonomy and setup by developer.

If you let business people to handle this then it gonna be really difficult to manage after some point of time.

Arun Patidar
    S
    santhiswaroopgAuthor
    April 6, 2021
    Thanks for the suggestion. Can you let me know what difficulties in specific do you foresee if business handles permissions
    MarkusBullaAdobe
    Adobe Employee
    MarkusBullaAdobeAdobe EmployeeAccepted solution
    Adobe Employee
    April 7, 2021

    When it comes to permission management there are two separate areas to look at:

     

    1. General permission setup for all users, groups and tenants/markets/etc.
      This should be a predefined hierarchy that is designed by your project-specific authorization matrix, implemented by your development team and rolled-out through your regular deployment process to create groups and assign ACLs. I recommend to leverage the Netcentric ACL Tool [1] for this.
    2. The "Private Folder" feature auf AEM Assets
      This is a different use case where regular AEM users (content authors) can create protected folders and authorize other users to access these private folders. See [2] for a documentation of this feature. In this case AEM will take care of creating groups and setting permissions on a lower (CRX) level when the content author adds users for collaboration to his private folder. AEM will also delete the according groups once access is revoked or the folder is deleted.

    While 1 is the basis for your projects overall authorization concept, 2 is a collaboration feature of AEM Assets that sits on top of 1.

     

    [1] https://github.com/Netcentric/accesscontroltool

    [2] https://experienceleague.adobe.com/docs/experience-manager-65/assets/managing/private-folder.html

      S
      santhiswaroopgAuthor
      April 8, 2021
      My business wanted to use the concept of private folders on DAM which has a potential to grow to terabytes of content. My question is is this encouraged or not. Do we face issues with governance and maintanence going forward?
      Terms & ConditionsAccessibility statement

      Loading footer...