Props for the detailed explanation.I will try to answer the questions. But first I have to advise you to start thinking about code and content when working with AEM. Since both reside in the same repository, it can get confusing.1. The project structure looks good. If it works in the demo author, th...

Try this in a helloworld. I would imagine that filter uses something like this to verify the referrer hosts.Pattern.compile(your regex).matcher("your referer url - only http(s)://host:port").matches()

I use this query regularly to get this information in json format. It works great at all path levels.http://localhost:8051/bin/querybuilder.json?type=dam:Asset&path=/content/dam&p.limit=-1

I think an Osgi configuration factory is what you are likely looking for. Here is a good reference on how to create those https://cqdump.wordpress.com/2014/08/05/managing-multiple-instances-of-services-osgi-service-factories/And you should not give authors access to your Felix console. Admins should...

Because that's the standard where same attribute shouldn't come under two different attribute names. If your SAML provider is not following the standard, you shouldn't expect AEM or any other product to handle that.If you want to make a user admin along with SAML SSO, I will suggest to create a cust...

kk krish wrote... Yes, Default group assignation is ok. But overriding the existing user assigned groups is a little weird. Any how i have one more curious question that how can we configure more than one Group Membership names in AEM, if my SAML assertion is capable sending multiple parameter names...

Yes. that's the expected behavior. You can have some default groups to which all users will be added to when they land in AEM.

As Justin said, this is supported OOTB with proper configuration. You need to configure the SAML handler for adding user to groups and the parameter name which will contain groups in the assertion. You also need to have those groups pre-created in AEM

How does your SAML handler config look like ? can you pls share some info.

Yes, my testing and observation is inline with the pseudo code in that documentation. So my understanding is that if Sling doesn't finds the exact path in the repo, it will start drilling down from root for a matching alias. And if the user doesn't have access to the root, it will fail at that first...