Security, Authentication, and Access Control for Forms
Access control model
AEM Forms uses AEM's JCR-based ACLs plus Forms-specific constructs. Know users, groups, and permissions on /content and /conf, and how form authors, form users, and administrators differ. Document Services endpoints and FDM data sources are protected resources; access depends on the invoking user or service user.
Authentication
Understand authentication handlers, SAML/OAuth for SSO, and service-user mappings for backend calls. Prefill and submit flows may run as the submitting user or as a configured service user; the choice affects what data is accessible. Know that Publish-side access to protected content requires proper dispatcher and authentication configuration.
Traps
- Assuming client-side rules or hidden fields provide security.
- Forgetting that service-user mappings can grant broader access than intended.
- Overlooking dispatcher rules when forms must be reachable anonymously.
- Confusing Author permissions with Publish runtime access.
Rule of thumb
For any access question, identify who is invoking (end user vs service user), what resource (form, FDM, Document Service), and which instance (Author vs Publish). Then check the ACL and authentication handler on that path. Most security questions resolve by naming the principal and the resource precisely.