# Aem Security Access Control

> AEM Security & Access Control

- Skill: `gabrielmoreira/aem-security-access-control` (Agent Skill)
- Install (CLI): `npx skillmds@latest add gabrielmoreira/aem-security-access-control`
- Raw SKILL.md: https://api.skillmd.com/api/skills/gabrielmoreira/aem-security-access-control/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: gabrielmoreira (https://skillmd.com/u/gabrielmoreira)
- Updated: 2026-09-21
- Page: https://skillmd.com/skills/gabrielmoreira/aem-security-access-control

---

# AEM Security & Access Control

## Purpose
Implement comprehensive security configurations including user/group management, ACL policies, CSRF protection, SSL configuration, and security hardening for AEM environments.

## When to Use (Triggers)
- User mentions "permissions," "ACL," "access control," or "security"
- References to users, groups, rep:policy, or service users
- Questions about CSRF tokens, SSL, SAML SSO, or authentication
- Requests involving content access restrictions or permission testing
- File paths containing `/home/users/`, `/home/groups/`, or `rep:policy` nodes

## Core Capabilities
- Design group hierarchies and permission inheritance strategies
- Implement fine-grained ACL policies using CRX DE or repoinit scripts
- Configure service users for OSGi bundles and system operations
- Set up SAML/OAuth/IMS authentication integration
- Apply AEM security hardening checklist and dispatcher security rules

## Domain Knowledge Required
### Technical Foundation
- JCR access control model (allow, deny, glob restrictions, rep:ntNames)
- Oak security architecture: authentication, authorization, principal management
- Service user mapping (`org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl`)
- Apache Sling authentication handler chain

### AEM-Specific Context
- AEM built-in groups (administrators, content-authors, dam-users, workflow-editors)
- Closed User Groups (CUG) for publish-side access restriction
- Adobe IMS integration for AEM Cloud Service
- Dispatcher security: filter rules, URL fingerprinting, DOT restriction
- Crypto support and credential storage in AEM

## Implementation Approach
### Step 1: Security Architecture
Define the permission model aligned with organizational structure.
- Map business roles to AEM functional groups
- Design group hierarchy (base groups → role groups → project groups)
- Plan content path access matrix
- Identify service accounts needed for system operations

### Step 2: Group & User Configuration
Implement the permission structure via repoinit or packages.
- Create groups using Sling repoinit scripts (preferred for Cloud Service)
- Define group nesting and membership
- Configure group profiles with descriptions
- Set up LDAP/SAML sync for external identity providers

### Step 3: ACL Policy Definition
Apply granular permissions to content paths.
- Define allow/deny ACEs on content paths
- Use glob restrictions for pattern-based access (`*/jcr:content/metadata`)
- Apply `rep:ntNames` restrictions for node-type filtering
- Configure `rep:itemNames` for property-level access control

### Step 4: Service User Setup
Create system accounts for bundle operations.
- Define service users via repoinit scripts
- Map service users to bundles using ServiceUserMapper
- Grant minimum required permissions to service users
- Validate service user resource resolution works correctly

### Step 5: Security Hardening
Apply defense-in-depth security measures.
- Configure CSRF filter allowlisting
- Enable and configure Content Security Policy headers
- Set up SSL/TLS on all environments
- Disable unused servlets and endpoints
- Configure Referrer Filter for cross-origin protection

## Quality Checklist
- [ ] All content authors can only access their designated content trees
- [ ] Service users follow principle of least privilege
- [ ] No anonymous access to sensitive content on publish
- [ ] CSRF protection active on all mutation endpoints
- [ ] Dispatcher filters block direct access to sensitive paths
- [ ] Admin accounts use strong authentication (IMS/SAML)
- [ ] Permission changes are version-controlled via repoinit scripts
- [ ] Security audit logs capture access violations

## Related Skills
- aem-dispatcher-configuration (security filtering)
- aem-monitoring-alerting (security event monitoring)
- aem-custom-osgi-services (service user usage)

## Example Use Cases
1. **Multi-Tenant Content Platform:** Design permission model for 15 content teams with strict content isolation, shared asset library access, and cross-team review workflows.
2. **Extranet with CUG:** Implement closed user group on publish with SAML-based login, token-based session management, and automatic session timeout with re-authentication.
3. **Service Account Hardening:** Audit and remediate service user permissions, replacing broad admin-like accounts with scoped service users per bundle using repoinit scripts.

## Notes
- AEM Cloud Service requires repoinit scripts for all user/group/ACL provisioning — no package-based deployment
- Deny ACEs take precedence at the same path; more-specific path ACEs take precedence over parent paths
- Never grant `jcr:all` to service users — always grant minimum required privileges
- Test permission changes with the "Impersonate" feature before deploying to production