jayproulx

Re: AEM user password expiry - Adobe Experience Manager 24-02-2017

Password expiry is an Apache Jackrabbit thing:Jackrabbit Oak - Password Expiry and Force Initial Password ChangeYou can change it in /system/console/configMgr, and grab the updated config in CRX DE in /apps/system/config, we drop that file in crx-quickstart/install for all of our servers.Additionally, I can confirm that this has been working for us in AEM 6.1 and 6.2 as well.

1.3K

content-authors access to Layouting mode? - Adobe Experience Manager 20-01-2017

It doesn't look like my content-authors have access to layouting mode in AEM 6.2. Design mode is activated by providing write access to the design, but layouting config is stored with the content node, is it a navigation item that needs access like the console nav?

163

Re: Exporting AEM users, groups and ACL permissions and importing to a different instance - Adobe Experience Manager 22-12-2016

Highly, highly worth mentioning, if you use the ACS ACL packager, be aware that it exports the whole _rep_policy.xml, not just the specific permissions for your authorizables. This more than likely means that package will not be compatible with any future versions of AEM. I.e. you're upgrading from 6.1 to 6.2, those _rep_policy.xml's may have entries that conflict with the latest updated policies in 6.2.If you're exporting, you'll want to hand-filter those policies and exclude anything that's no...

2.3K

Re: Groups and ACLs for external vendors? - Adobe Experience Manager 01-06-2016

Jörg Hoh wrote... Hi Jay, I appreciate your posting and thoroughness you put into it. You explain the basic idea quite well: First have a "deny all" rule (using wildcard ACLs where appropriate) and then give the group permission to the relevant of the repository. To be honest, I haven't had the time to write my posting in such a level of detail, but I am glad you did it 🙂 Your approach works fine, but building your complete group structure in a tree-ish way only works well, if you operate on a ...

936

Re: Groups and ACLs for external vendors? - Adobe Experience Manager 31-05-2016

Jörg Hoh wrote... Hi Jay, Basically I agree with the documentation, that you shouldn't use "DENY", but there is one big exception to this rule: You should have a group, which grants the minimal applicable permission set. For example you model a group "login only", which only allows to login to AEM, but not to see any regular content (for example denying ALL permissions on /content/* using wildcard ACL). Make sure, that this group is the very frist group in the group list of every user. And the y...

925

Re: Groups and ACLs for external vendors? - Adobe Experience Manager 03-05-2016

Thanks Scott!

927

Re: Groups and ACLs for external vendors? - Adobe Experience Manager 03-05-2016

In addition, there are commonly used folders like /etc/designs that contain a mix of AEM and project specific code. It’s relatively easy to blanket deny /content/* and /apps/*, but the same doesn’t apply for /etc/designs/* since there are a number of folders in there that are used by the system. We could deny all and then grant back all of the specific folders, but this sends us down a road where we’re using deny in all circumstances to define the base level of user access.It seems to me that wh...

923

Re: Groups and ACLs for external vendors? - Adobe Experience Manager 02-05-2016

As an aside, I’m also not receiving email updates when someone replies to this thread (in my inbox or spam), so I replied quickly previously from my phone when I received a satisfaction survey for this thread and saw that there were new replies.

928

Re: Groups and ACLs for external vendors? - Adobe Experience Manager 02-05-2016

Hi Scott,First of all, the answer is contradictory to the documentation: “Don’t use deny except for a certain group that all users should belong to which should do a wildcard deny”. I’ve been working on trying to create a group of users by following the documentation and granting only read access where required. Contributor has been the group that i’ve modeled my access after, however, removing jcr:read from / (and granting jcr:read to /apps and /libs, /etc) ends up breaking all of the UI’s (sit...

924