Ask the Experts Building LoginBased Sites in AEM

Agenda § Overview of AEM (Sling) Security Architecture § Adding Login § Adding Security

The Players § § Authentication in AEM is a collaboration between three players: § Sling Authentication interacts with the user’s HTTP request § Login. Modules validate credentials § Repository Access Control determines if an action is allowed Developing AEM applications requires understanding all of these. © 2015 Adobe Systems Incorporated. All Rights Reserved. Adobe Confidential. 3

Sling Authentication § Every request*… * With some exceptions © 2015 Adobe Systems Incorporated.

Sling Authentication – Authentication. Handler § Each Authentication. Handler can be assigned a path prefix. § § § In practice, most of the time, the path is / Authentication. Handlers are ordered based on service ranking § For extract. Credentials() – first non-null result wins § For request. Credentials() – first true response wins § For drop. Credentials() – all handlers are called There is also a optional Authentication. Feedback. Handler interface which Authentication. Handler can implement to… get feedback. © 2015 Adobe Systems Incorporated. All Rights Reserved. Adobe Confidential. 5

OOTB Authentication. Handlers § Http. Basic. Authentication. Handler § § CQ Login. Selector. Handler § § Facebook, Twitter, supported OOTB; others possible SAML Authentication Handler § § Handles form based login and token cookies Granite OAuth Bearer Authentication. Handler § § Handles path-specific login page redirects CRX Token. Authentication. Handler § § Handles HTTP Basic Authentication Supports SAML 2. 0 SSO Authentication Handler § Generic SSO Support – cookies, headers, parameters © 2015 Adobe Systems Incorporated. All Rights Reserved. Adobe Confidential. 6

Is Anonymous Access Allowed? § § By default: § Author – no § Publish – yes Exceptions defined two ways: § Configuration of the Sling. Authenticator OSGi component § Don’t reconfigure this. Just be aware. § Every OSGi service can have a sling. auth. requirements property § For example, to allow anonymous access to /mypath @Property(name=“sling. auth. requirements” value=“-/mypath”) § See /system/console/slingauth for the current aggregated configuration © 2015 Adobe Systems Incorporated. All Rights Reserved. Adobe Confidential. 7

Login. Module § A Login. Module is responsible for validating credentials. § Defined by the JAAS specification. § Multiple Login. Modules can be configured. § By default, AEM uses a single Login. Module § § § For CRX 2: § Jackrabbit provides a base Abstract. Login. Module specifically for working with Jackrabbit/CRX. § Read: http: //bit. ly/18 bl. UI 2 For Oak: § § Authenticates against the repository. Generally, you’ll use the new External. Login. Module by implementing External Identity Provider Note: Sling includes something called a Login. Module. Plugin. Don’t use this. It was a bad idea and doesn’t work. © 2015 Adobe Systems Incorporated. All Rights Reserved. Adobe Confidential. 8

Token Authentication § As part of login, CRX’s default Login. Module creates tokens in the repository which enables cookiebased login on subsequent requests. § These tokens are stored in the repository, e. g. § /home/users/a/admin/. tokens § This is NOT the same as “Remember Me”. § Tokens Expire: § § Cookies are session-bound. § Tokens in the repository have an expiration date and are purged. Tokens present challenges with clustering. § Login Request -> master, writes token to repository § Request #2 (with login-token cookie) -> slave, tries to read token § Fails if slave hasn’t sync’d yet © 2015 Adobe Systems Incorporated. All Rights Reserved. Adobe Confidential. 9

JCR Access Control § ACLs are an integral part of the repository § In JCR not only the enforcement is specified, but also APIs to modify ACLs. § Privileges include read, modify, create, remove, read. Access. Control, write. Access. Control, and more. . § Custom privileges are also possible. § Example: AEM Replication § ACL inheritance by path § For all JCR API calls the ACLs are considered when returning the results: § A JCR session is created for a specific user § Only readable nodes are returned in “node. get. Nodes()” § A search result only contains nodes visible to that user. © 2015 Adobe Systems Incorporated. All Rights Reserved. Adobe Confidential. 10

Do I Need To Write an Authentication. Handler? § If… § You need to support some custom type of credentials § You need SSO and you don’t support SAML 2. 0. § You need SSO and your SSO system can’t work with the SSO Authentication Handler. § § This can happen when the header is encrypted in some way. § Think about using a Filter instead of reimplementing the SSO Authentication Handler. You need to support “Remember Me” © 2015 Adobe Systems Incorporated. All Rights Reserved. Adobe Confidential. 11

Do I Need To Write a Login. Module (or External Identity Provider)? § If… § You need to integrate with an external identity provider at the credentials level. § § You need custom authentication for CRX DE Lite, CRX Explorer, or OSGi Console § § These systems generally do not support Sling Authentication. Handler. You need custom authentication for Web. DAV or Adobe Drive § § For example: LDAP (except this is supported out of the box) These only support basic authentication. You need custom authentication for another JCR client application § This will probably never be the case © 2015 Adobe Systems Incorporated. All Rights Reserved. Adobe Confidential. 12

“Live” Coding © 2015 Adobe Systems Incorporated. All Rights Reserved. Adobe Confidential. 13

Live Coding § Based on AEM 6. 0 SP 2; tested on 5. 6. 1 § Written in JSP § Users exist already § Users are local § Using Form Based Login © 2015 Adobe Systems Incorporated. All Rights Reserved. Adobe Confidential. 14

Form Based Login § Logging in via a form requires two parameters: § j_username - username § j_password – password § POST to <anything>/j_security_check § And two optional parameters: § resource – the path to redirect to on a successful login § j_validate– used for Ajax logins © 2015 Adobe Systems Incorporated. All Rights Reserved. Adobe Confidential. 15

Let’s Do This! © 2015 Adobe Systems Incorporated. All Rights Reserved. Adobe Confidential. 16

Resources § Code: http: //bit. ly/aem-ate-login-code § Permission Sensitive Caching Docs: http: //adobe. ly/1 v. SCs 3 v § Sling Authentication Docs: http: //bit. ly/1 zl 0 e 3 Z § Oak External Login Module Docs: http: //bit. ly/1 Fnk. NUw © 2015 Adobe Systems Incorporated. All Rights Reserved. Adobe Confidential. 17