Principal View for Permissions Management
Overview
AEM 6.5 introduces Permissions Management for Users and Groups. The main functionality remains the same as the classic UI, but is more user-friendly and efficient.
How to Use
Accessing the UI
The new UI-based permissions management is accessed through the Permissions card under Security as shown below:
The new view makes it easier to look at the whole set of privileges and restrictions for a given principal at all paths where Permissions have been granted explicitly. This removes the need to go to
CRXDE to manage advanced privileges and restrictions. It has been consolidated in the same view. The view defaults to the Group “everyone”.
There is a filter that allows the user to select the type of principals to look at Users, Groups, or All and search for any principal.
Viewing Permissions for a Principal
The frame on the left allows users to scroll down to find any principal or search for a Group or a User based on the selected filter, as shown below:
Clicking the name shows the assigned permissions on the right. The permissions pane shows the list of Access Control Entries on specific paths along with configured restrictions.
Adding new Access Control Entry for a Principal
New permissions can be added by adding an Access Controlling Entry. Simply click the Add ACE button.
This brings up the window shown below, the next step is to choose a path where the permission must be configured.
Here, a path is selected where you can configure a permission for dam-users:
After the path is selected, the workflow goes back to this screen, where the user can then select one or more of the privileges from the available namespaces (like jcr, rep or crx) as shown i below.
Privileges can be added by searching using the text field and then selecting from the list.
NOTE
After the list of privileges has been selected, the user can choose the Permission Type : Deny or Allow, as shown below.
Using Restrictions
In addition to the list of privileges and the Permission Type on a given path, this screen also lets you add restrictions for fine grained access control as shown below:
NOTERestrictions can be added as shown below by choosing the restriction type, entering the value and hitting the + icon.
The new ACE is reflected in the Access Control List as shown below. Note that jcr:write is an aggregate privilege that includes jcr:removeNode that was added above, but is not shown below as its covered under jcr:write.
