Security, Permissions, and User/Group Management
AEM security builds on Jackrabbit Oak and the JCR access control model. Understand users, groups, and the principals they represent; permissions are granted via ACLs (rep:policy) on nodes, with privileges like jcr:read, jcr:write, jcr:all. Know the difference between privileges and permissions, and how allow/deny entries combine (deny generally wins). Understand the everyone group and the anonymous user.
Key concepts: the user admin console, group membership, and impersonation. Closed user groups (CUG) restrict content on publish via cq:cugEnabled and login requirements. Understand the security checklist: disable default admin, use strong passwords, restrict /crx, /system/console, and /bin endpoints, and configure the Dispatcher filter accordingly.
Traps: granting permissions on /content broadly; forgetting that group membership changes require cache/replication considerations; confusing author vs publish permissions; assuming deny always overrides allow (ordering and specificity matter in Oak). Another trap: CUG requires the authentication handler and login page configuration.
Worked example: to restrict a section to a group, add a rep:policy on the node granting jcr:read to the group and denying to everyone, and configure CUG if it's publish-facing.
Rule of thumb: least privilege-grant to groups, not users; deny sensitive paths in both ACLs and Dispatcher filters.