Given that nothing in AEM uses JavaEE Sessions, your custom code must be creating those sessions. Just don't do that if this other cookie is set.

First off, since AEM supports SAML already, this is all unnecessary.In this particular case, you are likely embedding classes which should not be embedded because they are available from the JRE, via the system bundle. You are also embedding log bundles which are already available inside AEM.  I'd s...

Here's a trivial example of a Transfomer which adds "HELLO" inside comments: https://gist.github.com/justinedelson/cdcf502413740bef9539faf74385a599

Right, like I said, you wouldn't see the commented elements in the startElement(). You will see them (as text) in the characters() method. startElement() is useless for this use case as those aren't actually elements. They are text (character data in XML parlance).

Hi,This would theoretically be possible but it requires your Transformer implement the characters() method and parse the contents of that text yourself. If the contents of these comments are regular, you might be able to handle this with regex, but if the HTML is "normal" HTML, it is far from regula...

It would help if you could describe what end result you are trying to accomplish.Based on your description, you will need to reconfigure your IDP. Because when a user logs out of AEM (and you don't have Single Logout Configured), the next request from the user will get redirected to the IDP and then...

Yes, groups contained in the SAML assertion can be assigned to a user when the assertion is received if the SAML Authentication Handler is configured properly. See http://adobe.ly/1XJsIkQ.

It is hard to tell from this information what is going on. You first need to determine whether or not that request is getting to AEM. You can check this by comparing the web server access logs with the AEM access log. It sounds like it isn't (but that warrants doublechecking) in which case you may h...

Regarding the first scenario, what I was trying to say is that you cannot get the full functionality of AEM without syncing users. I suppose in some limited use case, this might work, but I've rarely see a case where only authentication was necessary or appropriately. After all, if you are authentic...

Hi,I don't think the first scenario is really work considering.For the second scenario, you should be using an Oak Identity Provider. No Custom Login Module would be necessary.Regards,Justin