AEM V2

​

Configure AEM Datasource

1. In Fusion, under Indexing > Datasources, click Add, then select AEM
2. Enter a Configuration ID
3. Enter the AEM URL (the URL used to access the AEM Admin UI) as well as the AEM username and password used to authenticate access to the QueryBuilder JSON Servlet.

4. Go to AEM to log in and access CRXDE Lite. In the CRXDE Lite UI, select a path to crawl. Enter this path into Fusion. Click Add to crawl multiple paths.

5. Optional: To exclude paths from the crawl, in Fusion, enter a Java Regular Expression (regex) that represents paths to exclude in the indexed content.

6. In Fusion, enter the AEM type to crawl. In the CRXDE Lite UI, this is the jcr:primaryType. In this example, the AEM connector is configured to crawl the AEM Type cq:Page, which represents web content pages.

7. To index assets with a particular file extension, locate a file type in CRXDE Lite and enter the value of the jcr:primaryType into Fusion. In this example, the value of NY_FairHealth.pdf is dam:Asset.

8. You can choose which content properties to include and exclude from the index. These parameter values are represented by Java regex. For example, to only include properties that start with “jcr” enter jcr:(.*).
9. In Fusion, click Save when you’re done configuring the AEM datasource.

​

Configuration settings

​

Field data population

​

Supported authorization options

curl -H 'Authorization: Bearer ACCESS_TOKEN' http://HOST:PORT/content/COMPANY/us/en/community/messaging.html

• From the datasource configuration
• From AEM server using Refresh Token
• From AEM server using JWT token

​

Getting Access Token

1. Open this URL in a browser:
   http://HOST:PORT/oauth/authorize?response_type=code&client_id=placeholderClientId&client_secret=CLIENT_SECRET&username=admin&password=PASSWORD&scope=offline_access&redirect_uri=REDIRECT_URI
   
2. You are redirected to login page (if you are not logged in):
3. Logging in redirects you to confirm the authorization. Click Yes, I authorize this request.
4. You are redirected to the URL provided in redirect_uri with parameter code: REDIRECT_URI?code=AUTHORIZATION_CODE.
5. Copy the value of the code parameter. This is your Authorization Code.
6. Execute the request to get Access Token:
   curl --location --request POST 'http://HOST:PORT/oauth/token?code=AUTHORIZATION_CODE&client_id=CLIENT_ID&client_secret=CLIENT_SECRET&grant_type=authorization_code&redirect_uri=REDIRECT_URI' --header 'Content-Type: application/x-www-form-urlencoded' --header 'Accept: application/json'
   
   Example:
   curl --location --request POST 'http://34.71.168.50:4502/oauth/token?code=AUTHORIZATION_CODE&client_id=CLIENT_ID&client_secret=CLIENT_SECRET&grant_type=authorization_code&redirect_uri=http://localhost:8080/test' --header 'Content-Type: application/x-www-form-urlencoded' --header 'Accept: application/json'
   
   Response:
   "access_token":"{placeholderAccessToken}","refresh_token":"{placeholderRefreshToken}","expires_in":3600
   

​

Getting Refresh Token

1. You must include offline_access in the scope list.
2. You must revoke all the previously obtained token. It can be done by clicking Revoke All Tokens.

​

Getting JWT Bearer Token

1. Download Private Key from the AEM Oauth client section. You should have downloaded file store.p12.
2. Run:
   openssl pkcs12 -in store.p12 -out store.crt.pem -clcerts -nokeys
   
   When asked about password type notasecret. You should have generated file named store.crt.pem.
3. Run:
   openssl pkcs12 -in store.p12 -passin pass:notasecret -nocerts -nodes -out store.private.key.txt
   
   You should have generated file named store.private.key.txt.
4. Create JWT token with the below payload and encrypt it with the private key using RS256:
   {
   "aud": "http://HOST:PORT/oauth/token",
   "iss": "CLIENT_ID",
   "sub": "USERNAME",
   "exp": <Current time in milliseconds+expiry>,
   "iat": <Current time in milliseconds>,
   "scope": "SCOPE",
   "cty": "code"
   }
   
   For example, install pyjwt with pip install pyjwt to encrypt with this python script:
   import jwt
   payload_data = {
   "aud": "http://34.71.168.50:4502/oauth/token",
   "iss": "dp0dtqd9lqpcntvb6t12hrscpa-z1hqkpdg",
   "sub": "admin",
   "exp": 1697840880541,
   "iat": 1697740880541,
   "scope": "offline_access",
   "cty": "code"
   }
   private_key = open('store.private.key.txt', 'r').read()
   token = jwt.encode(
       payload=payload_data,
       key=private_key,
       algorithm='RS256'
   )
   print(token)
   

​

Private key authentication (Adobe IMS)

1. Builds and signs a JWT (RS256) using the private key and configured claims.
2. Exchanges the JWT for an access token at https://ims-na1.adobelogin.com/ims/exchange/jwt/.
3. Automatically refreshes the access token on expiry with no manual intervention.