Product Communities

We recently had a security assessment that identified brute force vulnerabilities on our dispatcher URL. The assessment showed 190 consecutive login attempts were possible without any blocking mechanisms on /libs/granite/core/content/login.html.As an immediate mitigation, I'm planning to add these Dispatcher deny rules to block direct access to authentication endpoints:  /0300 { /type "deny" /url "/system/sling/login" }/0301 { /type "deny" /url "/system/sling/logout" }/0302 { /type "deny" /url "/libs/granite/core/content/login*" }/0303 { /type "deny" /url "/login*" }/0304 { /type "deny" /url "*/j_security_check*" }/0305 { /type "deny" /url "/j_security_check*" }Are these Dispatcher rules appropriate for blocking brute force attempts on AEM login endpoints?Will blocking /libs/granite/core/content/login.html break any legitimate AEM functionality?What additional AEM-specific configurations can help with brute force protection (rate limiting, account lockout, etc.)?Has anyone im

I would like to establish a user assigned managed identity with my azure subscription which has access to various resources (namely, a keyvault). How do I configure Federated Identity Credentials on this managed identity such that AEMaaCS can leverage it to communicate with my azure resources? Alternatively, is there any way to connect AEMaaCS to Azure Services without a Client Secret or pinned Client Certificate?

Hey folks,I have been trying to set up the universal editor on my local machine to perform authoring of my blocks. I have some custom blocks developed, and for now, I author them on the AEM cloud's Universal editor and publish the demo page to check for any authoring changes on my local ( which has been started by the 'aem up' command ). Yes, I can see any change I make regarding the decoration of these blocks on the go, but to make a change in the content, I need to update it on the Dev instance of my AEM Cloud Service. Then the same content is proxied in my local through the local ( by the grace of 'aem up' ). But is there any way I can make this change on my local and see the changes instantly? Does the underlying architecture allow for doing so?If anybody has an idea of how to solve this problem, please let me know. And there was an article by Adobe to set up a universal editor locally for React apps, I have followed the steps. Running Your Own Universal Editor Service |

Hi Everyone,I am currently working on Adobe Experience Manager 6.5.17 and implementing a custom EventHandler to listen for page deletion events using the PageEvent.EVENT_TOPIC.Here’s a snippet of my code:@8220494(service = EventHandler.class,immediate = true,property = {EventConstants.EVENT_TOPIC + "=" + PageEvent.EVENT_TOPIC})public class PageDeletionEventHandler implements EventHandler {private static final Logger LOG = LoggerFactory.getLogger(PageDeletionEventHandler.class);@9944223public void handleEvent(Event event) {LOG.info("Received event: {}", event.getTopic());PageEvent pageEvent = PageEvent.fromEvent(event);for (PageModification mod : pageEvent.getModifications()) {if (mod.getType() == PageModification.ModificationType.DELETED) {LOG.info("Page deleted at path: {}", mod.getPath());}}}} The handleEvent method is triggered correctly for CREATED and MODIFIED events - but not for DELETED events when I delete pages via the AEM Sites console.The bundle is active, the component

Uncaught TypeError: Cannot read properties of null (reading 'innerText')at HTMLElement._onOverlayToggle (coralui3.js:940:484)at Vent._executeListenersAtElement (coralui3.js:249:294)at Vent._executeBubbleListeners (coralui3.js:252:219)at Coral.Component.trigger (coralui3.js:354:7)at openComplete (coralui3.js:399:29)at coralui3.js:399:143 I am getting this issue when accessing dropdown in authoring field ,any one suggest the solution for this

carousel panel item name issue:i have inherited carousel component and created custom component and carousel panel select is impacted.custom component panel select is only showing child component name only for children's.but core component is showing child component name : item name for children's.i debugged the issue.. when i change custom component jcr title and component name to carousel, it shows proper name in panel select.can anyone suggest what exactly its happening.

The requirement is to create a datastream to push the event data using AEP event forwarding services. but the website doesn't have any launch container( neither dev or prod) implemented on the page.@brianau1

As you may have heard, a new version of the Salesforce CRM connector—specifically, the background synch process—will be rolled out in a phased approach across the Marketo Engage customer base starting in May 2025. We understand that CRM integration is a key component of your overall marketing strategy, and getting leads to your Sales teams in a timely manner is critical.   Benefit This new version will offer higher synch rates bidirectionally between Salesforce and Marketo Engage for higher volume needs. Higher sync rates will reduce the amount of backlog buildup caused by large amounts of data updates being sent through the integration. Some notable features that help manage this are the ability to push smaller batches and control the frequency of retry logic. The default retry logic frequency is set at every 5 minutes and can be reduced or increased as desired.   Overview/Technology Creating smaller batch sizes and being able to adjust the speed of retries provides higher e

I need an API to update the credentials for a Location Account pragmatically. 

Hello Team,We maintain a Global Report Suite along with multiple Virtual Report Suites derived from the Global one. While we can exclude bot-identified events or traffic at the Virtual Report Suite level, this functionality is not available in the Global Report Suite unless we manually apply a workspace segment (filtering based on specific dimensions).Our goal is to ensure data consistency and alignment between the Global and Virtual Report Suites to accommodate diverse business requirements.Has anyone else encountered this situation and identified an effective way to manage it?

Hello Community,I have created RepoInit scripts to create a service user and grant specific permissions. However, for some reason, I am unable to predict the behavior of the granted permissions. Initially, when the script was deployed to the instance, I observed the following permissions in the content repository:Read: YesModify: NoCreate: YesDelete: YesAfter several deployments (with no changes made to the script), I started noticing errors in the logs. Upon checking the permissions in the UserAdmin Console, I saw that the "Create" permission was no longer enabled. The updated permissions were:Read: YesModify: NoCreate: NoDelete: YesHere is the error log that I encountered: ERROR LOG: 2025-07-30 21:25:50.721 ERROR [com.xxx.yyy.aem.core.internal.impl.models.zzzz] RepositoryException while interacting with JCR: /content/project1/en/jcr:content/root/responsivegrid/layout_container_cop/content/layout_container_169/content/layout_container_108/c

Hi all, Let us say my component works fine on Author, but fails on Publish. What are all the ways to debug? I am aware of debug logging and also monitoring network tab using Developer tools.Is looking at the bundles in Felix to see whether bundle is active an option on Publish? Appreciate all your responses, Thanks,RK.

Hello,   We have a requirement where the data from the mobile app (tokens, events) need to be sent to prod and shadow prod environments simultaneously. How can this be configured on Launch ? Please let me know.   Thanks. Vikas.   @_manoj_kumar_  

Hello,I am quite sure, that I successfully did this long time ago, but currently it is not working as expected:For testing purposes, I would like to set up an OAuth2.0 connection to Workfront for the HTTP modules.Unfortunately I need some help on setting this up to let the HTTP modules use the access token within their calls. In the connection setup I defined:Token placement: In the headerHeader token name: sessionIDUnfortunately the Fusion DevTools just showAuthorization: "***",in the header and the API call fails due to an AuthenticationException.What am I doing wrong?Thanks in advance.RegardsLars 

Hi All, I had previously raised a question is we can pull the project name in the proof report? I received the below answer which worked perfectly fine:displayname=Project Name valuefield=documentVersion:document:project:name valueformat=HTMLNow I need to pull another field value in the report from the project. It is a custom field. Any idea how to do that? Thanks,Nisha 

Hi @sanfordwhiteman,  I’m currently working with UTM parameters and assigning values using global variables in email editor 2.0. However, the client reported an issue where this approach doesn’t work when dynamic content (segmentation) is used. After doing some research and testing, I found that global variables are indeed not compatible with dynamic content.   Could you please suggest a workaround or an alternative approach to address this issue?  

Hi all, Let us say I have created an Experience Fragment. When clients with different view ports require and request it, how AEM sends the right variant of it?Based on client view port the experience and Experience Fragment should be different. So, AEM creates Experience Fragments for each of view port sizes?How does it know which variant should be served for which client? Appreciate all your responses, Thanks,RK.

Error & AEM connection details 

Hi, 6.5 SP22 on prem user here. I am tasked to audit document files (30k+). My approach is to export a file report, then sort by used who uploaded, then modified. Then send a list of files to the user asking to audit their files. The challenge here is - I only want to first see the document files that are not referencing to websites.  Question:1. Can I add a property in the File Report that would display if the file is referencing or not (similar to what Renovator exports)?2. If above is No, what other report can I use / create that will show: Filepath, Uploader, Modifier, Referencing or Not? This has to be a UI solution please.  Thanks 

For one of my poc, I am planning to setup commerce cockpit and CIF components and I want to use Venia commerce store to setup(https://venia.magento.com/). I have downloaded and installed the package from https://github.com/adobe/aem-cif-guides-venia. I am trying to setup cloud config Here is my com.adobe.cq.commerce.graphql.client.impl.GraphqlClientImpl configGraphQL Service Identifier - https://venia.magento.com Commerce Cloud ConfI guess I should update "Catalog Root Category Identifier" . Does anyone know what should be the value for this field ?

Hey Community! Excited to offer an opportunity for a select few of you our valued customers. We're looking for three to four volunteers to test out our new AI tools. This is a unique chance to leverage AI to manage your work more efficiently.Interested in:•Understanding the scenarios where you'd use these AI tools (What/When/Why)•Receiving feedback on the user experience (UX)Your insights will be valuable in helping us refine our AI tools to better suit your needs.If you're interested, please respond to this post. Thanks for your time and consideration. 

I must be missing something but I couldn't find open rates in the email program a/b test dashboard, other than dividing the total number of opens (which I can see when I hover over the Click to Open section) by the total number of emails delivered.Also is there an easier way to get click through rate other than dividing the total number of clicks (which I get when I hover over the Clicks section) by the total number of emails delivered?Would be good also to see the exact click to open rate, I can see it's between two bandings in the graph and kind of guess it's closer to say 25% than 20% but I'd like to see the exact value.

Hi all, Let us say my site is integrated with SSO IDP Okta. When use logs in, IDP's login page appears and IDP collects user id and password.IDP authenticates and sends only token to AEM.1. From then for each of the requests from that client how the token is utilized?2. Where is the token stored or passed?3. How is the token mapped to the user? For that user AEM/IDP should not ask for user name and password. Appreciate all your responses, Thanks,RK.

Hello We have a node under each page with the same name. When we create a launch for the page the node also get created in the launch.On Launch promotion we do not want the information of this node to be promoted back to page as the information on this node might have been updated on page and we do not want it to be overridden.Any suggestions how we can achieve this?