Service credentials
Integrations with Adobe Experience Manager (AEM) as a Cloud Service must be able to securely authenticate to AEM service. AEM’s Developer Console grants access to Service Credentials, which are used to facilitate external applications, systems and services to programmatically interact with AEM Author or Publish services over HTTP.
AEM integrates with other Adobe products using S2S OAuth managed via the Adobe Developer Console. For custom integrations with service accounts, JWT credentials are used and managed in the AEM Developer Console.
Service Credentials may appear similar Local Development Access Tokens but are different in a few key ways:
- Service Credentials are associated with Technical Accounts. Multiple service credentials can be active for a Technical Account.
- Service Credentials are not access tokens, rather they are credentials that are used to obtain access tokens.
- Service Credentials are more permanent (their certificate’s expire every 365 days), and do not change unless revoked, whereas Local Development Access Tokens expire daily.
- Service Credentials for an AEM as a Cloud Service environment map to a single AEM technical account user, whereas Local Development Access Tokens authenticate as the AEM user who generated the access token.
- An AEM as a Cloud Service environment can have up to ten technical accounts, each with their own Service Credentials, each mapping to discrete technical account AEM user.
Both Service Credentials and the access tokens they generate, and Local Development Access Tokens, should be kept secret. As all three can be used to obtain, access to their respective AEM as a Cloud Service environment.
Generate Service Credentials
Service Credentials generation is broken into two steps:
- A one-time Technical Account creation by an Adobe IMS Org administrator
- The download and use of the Technical Account’s Service Credentials JSON
Create a Technical Account
Service Credentials, unlike Local Development Access Tokens, require a Technical Account to be created by an Adobe Org IMS Administrator before they can be downloaded. Discrete Technical Accounts should be created for each client that requires programmatic access to AEM.
Technical Accounts are created once, however the Private Keys uses to manage Service Credentials associated with the Technical Account can be managed over time. For example, new Private Key/Service Credentials must be generated prior to the current Private Key’s expiration, to allow for uninterrupted access by a user of the Service Credentials.
-
Ensure you are logged in as a:
- Adobe IMS Org’s System Administrator
- Member of the AEM Administrators IMS Product Profile on AEM Author
-
Log in to Adobe Cloud Manager
-
Open the Program containing the AEM as a Cloud Service environment to integrate set up the Service Credentials for
-
Tap the ellipsis next to the environment in the Environments section, and select Developer Console
-
Tap in the Integrations tab
-
Tap the Technical Accounts tab
-
Tap Create new technical account button
-
The Technical Account’s Service Credentials are initialized and displayed as JSON
Once the AEM as Cloud Service environment’s Service Credentials have been initialized, other AEM developers in your Adobe IMS Org can download them.
Download Service Credentials
Downloading the Service Credentials follows the similar steps as the initialization.
-
Ensure you are logged in as a:
- Adobe IMS Org’s Administrator
- Member of the AEM Administrators IMS Product Profile on AEM Author
-
Log in to Adobe Cloud Manager
-
Open the Program containing the AEM as a Cloud Service environment to integrate with
-
Tap the ellipsis next to the environment in the Environments section, and select Developer Console
-
Tap in the Integrations tab
-
Tap the Technical Accounts tab
-
Expand the Technical Account to be used
-
Expand the Private Key whose Service Credentials will be downloaded, and verify that the status is Active
-
Tap on the … > View associated with the Private Key, which displays the Service Credentials JSON
-
Tap on the download button in the top-left corner to download the JSON file containing the Service Credentials value, and save the file to a safe location
Install the Service Credentials
The Service Credentials provide the details needed to generate a JWT, which is exchanged for an access token used to authenticate with AEM as a Cloud Service. The Service Credentials must be stored in a secure location accessible by the external applications, systems, or services that use it to access AEM. How and where the Service Credentials are managed are unique per customer.
For simplicity, this tutorial passes the Service Credentials in via the command line. However, work with your IT Security team to understand how to store and access these credentials in accordance with your organization’s security guidelines.
- Copy the downloaded the Service Credentials JSON to a file named
service_token.jsonin the root of the project- Remember, never commit any credentials to Git!
Use Service Credentials
The Service Credentials, a fully formed JSON object, are not the same as the JWT nor the access token. Instead the Service Credentials (which contain a private key), are used to generate a JWT, which is exchanged with Adobe IMS APIs for an access token.
- Download the Service Credentials from AEM Developer Console to a secure location
- The External Application needs to programmatically interact with AEM as a Cloud Service environment
- The External Application reads in the Service Credentials from a secure location
- The External Application uses information from the Service Credentials to construct a JWT Token
- The JWT Token is sent to Adobe IMS to exchange for an access token
- Adobe IMS returns an access token that can be used to access AEM as a Cloud Service
- Access tokens can not change an expiry time.
- The External Application makes HTTP requests to AEM as a Cloud Service, adding the access token as a Bearer token to the HTTP requests’ Authorization header
- AEM as a Cloud Service receives the HTTP request, authenticates the request, and performs the work requested by the HTTP request, and returns an HTTP response back to the External Application
Updates to the External Application
To access AEM as a Cloud Service using the Service Credentials, the external application must be updated in three ways:
- Read in the Service Credentials
- For simplicity, the Service Credentials are read from the downloaded JSON file, however in real-use scenarios, Service Credentials must be securely stored in accordance to your organization’s security guidelines
- Generate a JWT from the Service Credentials
- Exchange the JWT for an access token
- When Service Credentials are present, the external application uses this access token instead of the Local Development Access Token, when accessing AEM as a Cloud Service
In this tutorial, Adobe’s @adobe/jwt-auth npm module is used to both, (1) generate the JWT from the Service Credentials, and (2) exchange it for an access token, in a single function call. If your application is not JavaScript based, please review the sample code in other languages for how to create a JWT from the Service Credentials, and exchange it for an access token with Adobe IMS.
