Restricting AEM consoles to a User

[divyak62111989]

Hi

There is a situation where a third party needs to read and write nodes in the content node of crx Author via an API. Since it's Author that they need access to, the AEM user credentials would be required by them for the read write to happen.  Now, what i thought was i'll create a user that has explicit access only to perform the read/write/delete/modify on the particular content path.

However, i would like to restrict access to all the AEM consoles to that user, if that's even possible. Basically, the user should not be able to do anything (or rather even view anything) apart from the job mentioned above as it's a third party.

I was hoping to get any inputs on this.

And also, if there is an alternative to providing user credentials to the third party to access Author, that would be great.

Thanks in advance.

[Rima_Mittal]

you can handle this If you create a user and only give it permission to the specific content path it needs to modify.

Allowing create, read and modify at /content/.. wont allow the user to access the consoles.

[divyak62111989]

Thank you...I had tried that before also. Just that, the user can view CRXDE Lite and the package manager..However, whenever the user tries to perform any of the actions, it does not work.

Just wanted to clarify if it is the right approach, giving a user's credentials to a third party. Even though they cannot really do anything (as far as the information that i could find suggests)

[Hemant_arora]

For your third party to read and write nodes in AEM, create a service user and add mapping in user mapper service. A service user is a JCR user with no password set and a minimal set of privileges that are necessary to perform a specific task. Having no password set means that it will not be possible to login with a service user. refer to https://helpx.adobe.com/experience-manager/6-3/sites/administering/using/security-service-users.html

[divyak62111989]

Actually, the thing is, the third party has to post data to a Sling post servlet in AEM author. I have tried hitting the servlet using POSTMAN..i need to provide basic auth (username and password) for the purpose.