Closed user groups using-closed-user-groups-with-aem-assets
Some assets need to stay hidden from the public even after you publish them, such as internal drafts, licensed content, or region-specific files. Closed User Groups (CUGs) let you publish a folder of assets while you still control exactly who can view it on the live site. This keeps sensitive assets out of search engines and away from unauthorized visitors, while the right users or groups can still access them.
In the Admin view, you set a CUG policy on a folder in AEM and publish it so the restriction takes effect on the live site. The video also shows how to require authentication and set a custom login page, so a blocked visitor lands on a sign-in page instead of a 404 error.
| embed |
|---|
| https://video.tv.adobe.com/v/22155?quality=12&learn=on |
https://video.tv.adobe.com/vc/22155/eng.json
Closed user group (CUG) with AEM Assets
- Designed to restrict access to assets on an AEM Publish instance.
- Grants read access to a set of users/groups.
- CUG can only be configured at a folder level. CUG cannot be set on individual assets.
- CUG policies are automatically inherited by any sub-folders and applied assets.
- CUG policies can be overridden by sub-folders by setting a new CUG policy. This should be used sparingly and is not considered a best practice.
- Changes to a folder’s CUG policy take effect only after you publish the folder.
- You can require authentication on a folder and set a login page, so an unauthenticated user who tries to access a restricted asset directly lands there instead of a 404 error.
| note caution |
|---|
| CAUTION |
| Configure your dispatcher so it doesn’t cache restricted content. Otherwise, an anonymous user could receive a cached copy of a page or asset that should require authentication. |
Closed user groups vs. access control lists closed-user-groups-vs-access-control-lists
Both Closed User Groups (CUG) and Access Control Lists (ACL) are used to control access to content in AEM and based on AEM Security users and groups. However the application and implementation of these features is very different. The following table summarizes the distinctions between the two features.
| table 0-row-3 1-row-3 2-row-3 3-row-3 | ||
|---|---|---|
| ACL | CUG | |
| Intended Use | Configure and apply permissions for content on the current AEM instance. | Configure CUG policies for content on AEM author instance. Apply CUG policies for content on AEM publish instance(s). |
| Permission Levels | Defines granted/denied permissions for users/groups for all levels: Read, Modify, Create, Delete, Read ACL, Edit ACL, Replicate. | Grants read access to a set of users/groups. Denies read access to all other users/groups. |
| Publication | ACLs are not published with content. | CUG policies are published with content. |