SystemPrincipalsValidation Warning: Refactor principal to have principal-based access control setup

[alisa-dev]

Hi All, 

I have warning in log file for all custom service users:

22.08.2025 19:42:19.681 [aem-author-786cd7b776-sddwr] *WARN* [JobHandler: /var/workflow/instances/server0/2025-08-22/custom-id-post-processing_1:/content/dam/assets/test.png] com.adobe.granite.repository.impl.SystemPrincipalsValidation Refactor principal 'custom-asset-service' to have principal-based access control setup.

I create users using yaml file:

- user_config:

    - custom-asset-service:
        - path: custom
          isSystemUser: true

- ace_config:

    - custom-asset-service:
        - path: /content/dam/assets
          permission: allow
          privileges: jcr:read

And my users mapping in .cfg.json:

{
  "user.mapping": [
    "aem-custom.core:id-images-service=[custom-asset-service]"
  ]
}

Could you please share how refactor principal to have principal-based access control setup?

@arunpatidar, @konstantyn_diachenko, @VeenaVikraman 

Best Regards,

Alisa

[HrishikeshKagne]

Hi @alisa-dev ,

That warning means your custom service users are still using the old ACL-based permissions, but Adobe now requires principal-based access control (PBAC) for all system users in AEMaaCS and modern AEM 6.5 setups. In simple terms:- instead of granting permissions with classic ACLs, you should define principal-based ACLs under /home/users/system/... using the PrincipalBasedAuthorizationConfiguration. So, refactoring means updating your YAML or repo-init so that the service user’s permissions are applied as principal-based rules (e.g., set principal ACL for custom-asset-service), not by attaching node ACLs directly. This way the system user gets its rights via PBAC, the warning goes away, and your service account follows Adobe’s recommended security model.

[alisa-dev]

Hi @HrishikeshKagne

thank you for your reply!

I change path for custom system user to system/cq:services/custom:

- user_config:

    - custom-asset-service:
        - path: system/cq:services/custom
          isSystemUser: true

- ace_config:

    - custom-asset-service:
        - path: /content/dam/assets
          permission: allow
          privileges: jcr:read

 but in repo for my user I can not see rep:principalPolicy node with user permissions:

Could you please share how I need to create user config for applying right permissions?

[arunpatidar]

Hi @alisa-dev 

Please check https://experienceleaguecommunities.adobe.com/t5/adobe-experience-manager/console-error-principle-ba... 

[alisa-dev]

Hi @arunpatidar 

thank you for your reply!

I checked this post and I have same configuration but still see warning in log files.

[arunpatidar]

Hi @alisa-dev 

Try with below

- user_config:

    - custom-asset-service:
        - path: system/cq:services/custom
          isSystemUser: true
          name: custom-asset-service

- ace_config:

    - custom-asset-service:
        - path: /content/dam/assets
          permission: allow
          privileges: jcr:read

[kautuk_sahni]

@arunpatidar just checking in! Were you able to get this resolved? If one of the replies above helped—whether it completely solved the issue or simply pointed you in the right direction—marking it as accepted can make it much easier for others with the same question to find a solution. And if you found a different way to fix it, sharing your approach would be a great contribution to the community. Your follow-up not only helps close the loop but also ensures others benefit from your experience. Thanks so much for being part of the conversation!