Login & permissions issues
Purpose: Diagnose authentication failures and the "user can't see / can't do X" family.
Who this page is for
| Audience | Why it matters to you |
|---|---|
| All engineers | Frequent support tickets |
| Platform engineers | SSO plumbing |
Split the problem immediately
| Statement | Lane |
|---|---|
| "Can't log in at all" | Authentication lane |
| "Logged in but can't see/edit/publish X" | Authorisation lane |
| "Anonymous users get 404 on published page" | Publish-ACL lane |
Authentication lane
- One user or everyone? Everyone + SSO = IdP/SAML lane: cert expiry (the #1), clock skew breaking assertion validity, IdP-side change (SSO overview). error.log's SAML entries name the failure.
- One user: exists? disabled? IdP sends the right identifier? (auto-create on, mapping right?)
- Publish farm login weirdness (works then doesn't per request): encapsulated-token/key sync across publishers (security model defaults list).
- Break-glass: local login URL bypasses SSO for admins — if that works, it's cleanly an SSO-chain problem.
Authorisation lane
- Reproduce as the user (impersonation) — "it works for me (as admin)" diagnoses nothing.
- Effective permissions on the node: CRXDE Access Control tab / permissions UI — remember evaluation is nearest-rule-wins up the tree with deny beating allow at equal depth (users & groups).
- Group membership: is the user actually IN the group everyone assumes? (SSO group mapping drops are silent — compare IdP assertion groups vs AEM memberships.)
- The action, precisely: "can't publish" = replicate permission or the approval workflow doing its job (governance — check before "fixing").
Publish-ACL lane
Page 404s for anonymous but exists: anonymous read ACL missing on publish — was the ACL-bearing ancestor replicated? New tree roots need their permissions activated too; diff effective anonymous read on author-publish for the path.
Log the resolution
Permissions fixes without a note become permissions archaeology; record what was granted, to whom, why, expiry (audit rhythm).