Setting up and organizing users

When you create users, you can add the them to groups and assign roles to the them.

If you are using Content Services (Deprecated), you can select the Select This Option For Pushing Users And Groups Into Registered External Principal Storage Providers option on the Domain Management page to push the information for new users or groups you create in Content Services (Deprecated).

1. In administration console, click Settings > User Management > Users and Groups, and click New User.

2. Under General Settings, provide information as required, and then click Next. For details about the settings, see User settings .

3. (Optional) To add the user to a group, click Find Groups, and do these tasks:

   • In the Find box, type all or part of the group name.

   • Select the domain to search, select the number of items to display, and click Find.

   • (Optional) To view group details, select the group name, and then click OK to return to the search results page.

   • Select the check box for the group and click OK.

   • Click Next.

4. (Optional) To assign roles to the user, click Find Roles, select the check box for the roles to assign, and then click OK.

5. Click Finish.

Specify the following settings when you create or edit a user.

Canonical Name: (Mandatory) Unique identifier for the user. Each user and group in a domain must have a unique canonical name. Select the System Generated checkbox to let User Management assign a unique value, or clear the checkbox and specify a custom value for the Canonical Name.

Avoid using underscore characters (_) in canonical names, for example, sample_user . When you search for users based on their canonical name, those containing underscore characters are not returned.

First Name: (Mandatory) User’s given name

Last Name: (Mandatory) User’s family name

Common Name: Full name or display name for the user. For example, if First Name = Gloria and Last Name = Rios, then Common Name = Gloria Rios.

Email: User’s email address

Telephone: User’s telephone number

Description: Optional description. Use this field as suits your organization’s needs.

Address: User’s mailing address

Organization: Organization to which the user belongs

Email Aliases: User’s email aliases. Separate the email aliases with commas.

Domain: Domain to which the user belongs

Locale: User’s ISO locale

Business Calendar Key: Enables you to map a business calendar to a user, based on the value for this setting. Business calendars define business and non-business days. AEM forms can use business calendars when calculating future dates and times for events such as reminders, deadlines, and escalations. The way that you assign business calendar keys to users depends on whether you are using an enterprise, local, or hybrid domain. (See Adding domains .)

If you are using a local or hybrid domain, information about users is stored only in the User Management database. For these users, set the Business Calendar Key to a string. Then map the business calendar key (the string) to a business calendar in forms workflow.

If you are using an enterprise domain, information about users resides in a third-party storage system, such as an LDAP directory. User Management synchronizes user information from the directory with the User Management database. This feature allows you to map a business calendar key to a field in the LDAP directory. For example, consider a scenario where each user record in your directory contains a country field, and you want to assign business calendars based on the country where the user is located. In this case, you specify the country field name as the value for the Business Calendar Key setting. You can then map the business calendar keys (the values defined for the country field in the LDAP directory) to business calendars in forms workflow.

For additional information on business calendars, including how to map business calendar keys to business calendars, see Configuring Business Calendars .

Limit the name to less than 53 characters. A shorter name helps prevent problems displaying the business calendar key in the Process Management pages in administration console.

User ID: (Mandatory) User ID that the user uses to log in. User ID is not case sensitive and it must be unique across the domain.

In enterprise domains, use a non-DN attribute as the user ID because a user’s DN can change if they move to another part of the organization. This setting depends on the directory server. The value is objectGUID for Active Directory 2003, nsuniqueID for Sun™ One, and guid for eDirectory.

Ensure that the user ID is unique. Do not use one that was assigned to a deleted user.

AEM forms cannot differentiate between user accounts that have identical user IDs and passwords but belong to different domains. To avoid this problem, do not create accounts that have the same user ID on multiple domains.

When using SQL Server as your database, you cannot create a user ID that exceeds 255 characters.

When using MySQL, the user ID can contain extended characters. However, when a comparison is made between two strings, such as abcde and âbcdè, they are considered the same. For example, when syncing, if a new user was added to the database, a comparison is made to check whether a user with the same user ID exists in the database. If user abcde already exists in the database when the new user âbcdè is added, the comparison cannot distinguish between the two names. It is assumed that the user already exists in the database, and the new user is ignored and not added.

Avoid creating user names that begin with a number sign (#). Performing task searches returns no results for those user names. (See Working with tasks .)

Password and Confirm Password: Password the user uses to log in. It must have a minimum of eight characters. A password is not required for a user who is part of a hybrid domain.

1. In administration console, click Settings > User Management > Users and Groups.

2. Specify information to narrow the search and, in the In list, select Users and then click Find. The results of the search are listed at the bottom of the page. You can sort the list by clicking any of the column headings.

3. Click the name of the user to display details about. The Edit User page displays such details as below about the user:

   • General identification information, such as name, email, address, domain, and organization

   • Roles assigned to the user

   • Groups the user is a member of

1. In administration console, click Settings > User Management > Users and Groups.

2. Specify information to narrow the search for a particular user and click Find. The results of the search are listed at the bottom of the page. You can sort the list by clicking any of the column headings.

3. Click the name of the user and then click Change Password.

4. Type and confirm the new password, and then click OK. The password must be a minimum of eight characters.

1. In administration console, click Settings > User Management > Users and Groups.

2. To find the user to edit, do these tasks:

   • In the Find box, type your search criteria.

   • In the Using list, select Name, Email, or User ID.

   • In the In list, select Users.

   • Select the domain, select the number of items to display, and then click Find.

3. Click the user to edit.

4. For a user who is part of a local or hybrid domain, on the Detail tab, edit the General Settings and Login Settings, and click Save. For details about the settings, see User settings . You cannot edit the general and login settings for a user who belongs to an enterprise domain.

5. To edit the group settings for the user, click the Group Membership tab and do these tasks:

   • Click Find Group and complete the search information.

   • To add the user to a new group, select the check box for the group, click OK, and then click Save.

     Note: Local users cannot be added to directory groups. However, directory users can be added to local groups.

   • To remove the user from a group, select the check box for the group, click Delete, and then click Save.

6. To edit the user’s roles, click the Role Assignments tab and do these tasks:

   • To display a list of roles, click Find Roles.

   • To add a role, select the check box for the role, click OK, and then click Save.

   • To remove a role, select the check box for the role, click Unassign, and then click Save.

1. In administration console, click Settings > User Management > Users and Groups.

2. To find the user to delete, do these tasks:

   • In the Find box, type your search criteria.

   • In the Using list, select Name, Email, or User ID.

   • In the In list, select Users.

   • Select the domain, select the number of items to display, and then click Find.

3. Select the check box for the user, click Delete, and then click OK.

If a user without the required AEM forms and CQ permissions, attempts to log into the following applications embedded in CQ, the user is redirected to the default CQ 404 page containing the error trace:

• Correspondence Management solution

• AEM forms Workspace

  Note: The Flex Worksapce is deprecated for AEM forms release.

• forms manager

• Process Reporting

CQ provides a mechanism to override the default 404 handler jsp.

For details on how to to customize the error handling page, see Customizing Pages shown by the Error Handler in the Adobe Experience Manager Documentation.

When you manually create a group, you can add users and other groups to it and assign roles to the group. You can also associate the group with a parent group.

If you are using Content Services (Deprecated), you can select the Select This Option For Pushing Users And Groups Into Registered External Principal Storage Providers option on the Domain Management page to push the information for any new users or groups that you create in Content Services (Deprecated).

1. In administration console, click Settings > User Management > Users And Groups, and then click New Group.

2. Complete the General Settings section and click Next. Canonical Name and Group Name are mandatory attributes.

   The Canonical Name is a unique identifier for the group. Each group and user in a domain must have a unique canonical name. Select the System Generated checkbox to let User Management assign a unique value, or clear the checkbox and specify a custom value for the Canonical Name.

   Avoid using underscore characters (_) in canonical names, for example, sample_group . When you search for groups based on their canonical name, those containing underscore characters are not returned.

3. To add users and groups to this new group, click Find Users/Groups and do these tasks:

   • In the Find box, type your search criteria.

   • In the In list, select Users, Groups, or Users and Groups.

   • In the Using list, select Name, Email, or User ID.

   • Select the domain, select the number of items to display and click Find.

   • In the search results, select the check boxes for the users and groups to add to this new group and click OK.

4. Click Next.

5. To add this new group to other existing groups, click Find Groups and do these tasks:

   • In the Find box, type your search criteria.

   • Select the domain, select the number of items to display, and click Find.

   • In the search results, select the check boxes for the groups that the new group belongs to and click OK.

6. Click Next.

7. To assign roles to the group, click Find Roles, select the check boxes for each role to assign to the group and click OK. Users in the group inherit roles that are assigned at the group level.

8. Click Finish.

In a dynamic group, you do not individually select the users who belong to the group. Instead, you specify a set of rules and all users who meet those rules are automatically added to the dynamic group.

Use one of these two ways to create dynamic groups:

• Enable the automatic creation of dynamic groups based on email domains, such as @adobe.com. When you enable this feature, User Management creates a dynamic group for each unique email domain in the AEM forms database. Use a cron expression to specify how often User Management searches the AEM forms database for new email domains. These dynamic groups are added to the DefaultDom local domain and are named "All users with an [email domain] mail ID."

• Create a dynamic group based on specified criteria, including the user’s email domain, description, canonical name, and domain name. To belong to the dynamic group, a user must meet all the specified criteria. To set up an "or" condition, create two separate dynamic groups and add them both to a local group. For example, use that approach to create a group of users who belong to the @adobe.com email domain or whose canonical name contains ou=adobe.com. However, the users do not necessarily have to meet both conditions.

A dynamic group contains only users. It cannot contain other groups. However, a dynamic group can belong to a parent group.

1. In administration console, click Settings > User Management > Users and Groups.

2. In the In list, select Group, and then click Find. The results of the search are listed at the bottom of the page. You can sort the list by clicking any of the column headings.

3. Click the name of the group to display details about. The Group Detail page appears.

4. To view direct members of the group, click Child Principals.

1. In administration console, click Settings > User Management > Users And Groups.

2. To find the group to edit, do these tasks:

   • In the Find box, type your search criteria.

   • In the Using list, select Name or Email.

   • In the In list, select Groups.

   • Select the domain, select the number of items to display, and click Find.

   • In the search results, click the name of the group to edit.

3. On the Details tab, edit the general settings and click Save.

4. To edit the associated groups, click the Parent Groups tab and do these tasks:

   • To find groups to add to the association, click Find Groups and complete the search information.

   • To add groups, select the check box for the groups to add, click OK, and then click Save.

   • To delete an associated group, select the check box for the group to delete, click Delete, click OK, and then click Save.

5. To edit the users and groups in the group, click the Child Principals tab and do these tasks:

   • To find users and groups to add, click Find Users/Groups and complete the search information.

   • To add a user or group, select the check box for the user or group, click OK, and click then Save.

   • To delete a user or group, select the check box for the user or group, click Delete, click OK, and then click Save.

6. To edit role assignments, click the Role Assignments tab and do these tasks:

   • To find roles to assign to the group, click Find Roles.

   • To add a role, select the check box for the role, click OK, and then click Save.

   • To unassign a role, select the check box for the role, click Unassign, and then click Save.

1. In administration console, click Settings > User Management > Users And Groups.

2. In the Find list, select Groups, and then click Find.

3. Select the check box for the group to delete, click Delete, and then click OK.

The following default roles are included in the User Management database.

administration console User:

Can access administration console.

Application Administrator:

Can use all Workbench features. Can use the Applications and Services pages in administration console to configure service run-time properties, endpoints, and security.

AEM forms Administrator:

Can perform all tasks for all installed services.

Security Administrator:

Controls User Management settings, and manages users and groups that are associated with any User Manager domain

Services User:

Can view and invoke any service

Super Administrator:

Has access to all administrative functionality in the system, including services

Trust Administrator:

Can manage the PKI trust settings and PKI credentials that are managed from the Trust Store Management page in administration console

1. In administration console, click Settings > User Management > Role Management, and then click New Role.

2. In the Role Name box, type a name for the role and, optionally, type a description of the role, and then click Next.

   Note: When using MySQL, you cannot create two roles that have the same name but differ in the use of extended characters. For example, attempting to create a role named abcde when one named âbcdè already exists results in an error.

3. Click Find Permissions, select the permissions to add to the role.

4. Click OK and then click Next.

5. Assign this role to users and groups:

   • Click Find Users/Groups.

   • In the Find box, type your search criteria.

   • Select Name, Email, or User ID, and then select Users, Groups, or Users and Groups.

   • Select the domain, select the number of results to display, and click Find.

   • Select the check boxes for the users and groups to assign this role to and click OK.

6. To view user and group details, select the entity.

7. Click OK and then click Finish.

1. In administration console, click Settings > User Management > Role Management, and then click Role Name.

   By default, the Role Management page displays all the roles in the User Management database. If the list of roles is large, use the Find area at the top of the page to search for a specific role name.

2. Click the role to edit, edit the general settings, and click Save.

3. To edit role permissions, click the Permissions tab and do these tasks:

   • To add new permissions, click Find Permissions, select the check boxes for the permissions to add, click OK, and then click Save.

   • To delete a permission from the role, select the check box for the permission, click Delete, and then click Save.

4. To manage who the role is assigned to, click the Role Users tab and do these tasks:

   • To assign the role to new users and groups, click Find Users/Groups, and complete the search information. Select the check box for each user and group to assign this role to, click OK, and then click Save.

   • To remove the role, select the check box for the users or group, click Unassign, and then click Save.

You can delete any of the roles that you created, but not the default AEM forms roles that are included in the product.

1. In administration console, click Settings > User Management > Role Management, and then click Role Name.

   By default, the Role Management page displays all the roles in the User Management database. If the list of roles is large, use the Find area at the top of the page to search for a specific role name.

2. Select the check box for the role to delete, click Delete, and then click OK.

1. In administration console, click Settings > User Management > Users and Groups.

2. Specify information to narrow the search and click Find. The results of the search are listed at the bottom of the page. You can sort the list by clicking any of the column headings.

3. Select the check boxes beside the users and groups to associate with a role and click Assign Role.

4. Select the role to assign to the user or group and click OK.

You can also assign roles by using the Role Management page.

1. In administration console, click Settings > User Management > Role Management, and then click Role Name.

   By default, the Role Management page displays all the roles in the User Management database. If the list of roles is large, use the Find area at the top of the page to search for a specific role name.

2. On the Role Detail page, click the Role Users tab. A list of users and groups that are directly associated with the role are displayed.

You can change the permissions for any of the roles that you created. You cannot change the permissions for the default AEM forms roles that are included in the product.

1. In administration console, click Settings > User Management > Role Management, and then click Role Name.

   By default, the Role Management page displays all the roles in the User Management database. If the list of roles is large, use the Find area at the top of the page to search for a specific role name.

2. Select the role to view permissions for and click the Permissions tab.

3. To change these permissions, click Find Permissions, select the check boxes for the permissions to add to the role, click OK, and then click Save.

4. To delete a permission, select the permission, click Delete, and then click Save.

Use the Role Management page to remove users and groups from a particular role. If the user or group inherited the role assignment, you cannot remove the role at the user or group level. Either remove the user or group from the inheritance tree or remove the role from the parent.

1. In administration console, click Settings > User Management > Role Management, and then click Role Name.

   By default, the Role Management page displays all the roles in the User Management database. If the list of roles is large, use the Find area at the top of the page to search for a specific role name.

2. In the list of roles, click the name of the role to update and then click the Role Users tab. A list of users and groups associated with the role are displayed.

3. Select the check boxes for the users and groups to remove from the role and click Unassign.

4. Click Save and then click OK.

This is how traditional authentication works:

1. When a user tries to log in to AEM forms, User Management passes the user’s credentials sequentially to all available authentication providers. (Login credentials include a username/password combination, Kerberos ticket, PKCS7 signature, and so on.)

2. The authentication provider validates the credentials.

3. The authentication provider then checks whether the user exists in the User Management database. The following results are possible:

   Exists:

   If the user is current and unlocked, User Management returns authentication success. However, if the user is not current or is locked, User Management returns authentication failure.

   Does not exist:

   User Management returns authentication failure.

   Invalid:

   User Management returns authentication failure.

4. The result returned by the authentication provider is evaluated. If the authentication provider returned authentication success, the user is allowed to log in. Otherwise, User Management checks with the next authentication provider (steps 2-3).

5. Authentication failure is returned if no available authentication provider validates the user credentials.

When just-in-time provisioning is implemented, a new user is created dynamically in User Management if one of the authentication providers validates the user’s credentials. (After step 3 in the traditional authentication procedure, above.)

Assume that a user is trying to log in to AEM forms and an authentication provider accepts their user credentials. If the user doesn’t yet exist in the User Management database, the identity check for the user fails. AEM forms now performs the following actions:

1. Create a UserProvisioningBO object with the authentication data and place it in a credential map.

2. Based on domain information returned by UserProvisioningBO , fetch and invoke the registered IdentityCreator and AssignmentProvider for the domain.

3. Invoke IdentityCreator . If it returns a successful AuthResponse , extract UserInfo from the credential map. Pass it to the AssignmentProvider for group/role assignment and any other post-processing after the user is created.

4. If the user is created successfully, return the login attempt by the user as successful.

5. For hybrid domains, pull user information from the authentication data provided to the authentication provider. If this information is fetched successfully, create the user on-the-fly.