Hi Kumar,We ultimately abandoned this requirement but we did manage to get something working.We created a custom authentication handler by extending SamlAuthenticationHandler. In extractCredentials() we explicitly check the request path and the user's group membership and return FAIL_AUTH if we need...

Hmmmm...Maybe I'm mistaken. This doesn't seem to work without a custom transformer.

Thanks for all the comments, everyone. I believe this is the solution:I need to configure the Sling Rewriter as described here:http://wcm.io/handler/url/rewriter.htmlIt's a special configuration that goes under /apps/{appName}/config/rewriter/{configName}.The important part looks like this:<generato...

Hi Jitendra,Thanks for the suggestion.I tried adding a few different mappings for /content/dam but it doesn't seem to make a difference.For now I'm mapping /content/dam to itself so that it's effectively excluded from the mapping. So direct requests to images under /content/dam work correctly.Howeve...

Hi Everyone,I'm using /etc/map rules to remove /content/appname from requests. This works properly for incoming HTTP requests.However, image tags rendered in Sightly templates are not rewritten. For example, if I have an image component at /content/app1/en/news/image, the src attributes in the image...

Is Dispatcher definitely loading the correct dispatcher.any file?

So sorry, I don't have a working configuration file.Are you sure that Dispatcher is loading the correct configuration file? If you intentionally break the configuration do you see errors in the Dispatcher log?For example, if you change "/auth_checker" to "/auth_checker_broken" or just "auth_checker_...

Thanks, Opkar.Unfortunately the same user can have access to both areas. That's really the main complication here.A user can have access (via group membership) to both paths. But they still need to authenticate a second time when accessing a SAML2 path. 

Ok sorry. I configured permission sensitive caching a while ago and I recall that I had to futz with the configuration to get it right. But I don't remember what exactly was the problem.If you put some garbage in there or misspell auth_checker does Dispatcher complain after startup about the broken ...

Hi All,I have a business requirement where I need to protect 2 paths with different SAML configurations in AEM 6.1. Each path has a different level of security and different IDP login/logout URLs.Additionally, if a user is logged in via path1 (SAML1 configuration) and attempts to access path2, then ...