Security Archives - Sourced Code

resourceResolverFactory.getAdministrativeResourceResolver(null) WhiteList Bundle for Administrative Login

briankasingli — Thu, 17 Nov 2022 02:18:06 +0000

When working for organizations with the goal of migrating from AEM 6X to 6.5 or to AEM Cloud as a Service. It’s very common that the AEM backend code still utilizes the deprecated resourceResolverFactory.getAdministrativeResourceResolver(null) @depricated API. This method has been deprecated as of 2.4 (bundle version 2.5.0) because of inherent security issues. Services requiring specific permissions should use the getServiceResourceResolver(), AEM service users instead.

1
2
3
4
5

try (ResourceResolver resolver = resourceResolverFactory.getAdministrativeResourceResolver(null)) {
// do something
} catch (LoginException e) {
e.printStackTrace();
}

In the later versions of AEM, from the default AEM environment configurations, it has disabled the use of resourceResolverFactory.getAdministrativeResourceResolver(null) because of inherent security issues and has disabled the API. Without any configurations made on AEM, the AEM environment will causes the API call to not work as expected, and the resourceResolverFactory.getAdministrativeResourceResolver(null) returns as a null object.

Solving the Issue

During times of rapid development, developers are not positions to refactor the deprecated API. That’s okay. AEM provides configuration to re-enable this disabled feature as a temporary solution for the environment to allow the deprecated API. You have two options.

Quick Links

Apache Sling Login Admin Whitelist
Apache Sling Login Admin Whitelist Configuration Fragment

Visit http://localhost:4502/system/console/configMgr/org.apache.sling.jcr.base.internal.LoginAdminWhitelist

whitelist.bypass: {Boolean} if true, by default all the bundles will be allowed to use getAdministrativeResourceResolver() deprecated API.
whitelist.bundles.regexp: Regular expression for bundle symbolic names for which loginAdministrative() is allowed. NOT recommended for production use, but useful for testing with generated bundles.

http://localhost:4502/system/console/configMgr/org.apache.sling.jcr.base.internal.LoginAdminWhitelist.fragment

whitelist.name: Optional name to disambiguate configurations.
whitelist.bundles: A list of bundle symbolic names allowed to use loginAdministrative().

The post resourceResolverFactory.getAdministrativeResourceResolver(null) WhiteList Bundle for Administrative Login appeared first on Sourced Code.

How to get Authorization: Basic Auth Header from AEM Author

briankasingli — Tue, 29 Jun 2021 23:35:03 +0000

Getting the Authorization (Basic access authentication) Basic Auth Header from AEM Author is simple. If you have curl installed on your machine, simply run the command below, and you should be able to get the Authorization header from a successful AEM login.

What we are doing here is logging into the AEM author with curl using -v (verbose) & -u (user:pass).

curl request:

1	curl -v -u admin:admin http://localhost:4502

curl response (line::8):

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16

* Rebuilt URL to: http://localhost:4502/
* Trying ::1...
* TCP_NODELAY set
* Connected to localhost (::1) port 4502 (#0)
* Server auth using Basic with user 'admin'
> GET / HTTP/1.1
> Host: localhost:4502
> Authorization: Basic YWRtaW46YWRtaW4=
> User-Agent: curl/7.54.0
> Accept: */*
>
< HTTP/1.1 302 Found
< Location: /index.html
< Transfer-Encoding: chunked
<
* Connection #0 to host localhost left intact

Authorization Basic:

1	Authorization: Basic YWRtaW46YWRtaW4=

The post How to get Authorization: Basic Auth Header from AEM Author appeared first on Sourced Code.

Sugar Coat Registered AEM Servlet Scripts and Paths Endpoint

briankasingli — Mon, 02 Dec 2019 21:08:21 +0000

In AEM we tend to write Sling Servlet OSGI Services to expose JSON data using the various service reference properties such as “sling.servlet.paths”, “sling.servlet.resourceTypes”, “sling.servlet.selectors”, and “sling.servlet.extensions”.

Example 1: DirectoriesServlet.Java doGet Servlet Implementation (html extension):
This is an example how a servlet in AEM to retrieve the directories JSON data.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

// example for /content/mysite.directories.html
@SlingServlet(
resourceTypes = "/apps/mysite/components/page/basepage",
selectors = "directory",
extensions = "html",
methods = "GET")
public class MyServlet extends SlingSafeMethodsServlet {
@Override
protected void doGet(SlingHttpServletRequest request, SlingHttpServletResponse response) throws ServletException, IOException {
response.setStatus(HttpStatus.OK_200);
response.setContentType(APPLICATION_JSON_UTF8);
response.setHeader(HttpHeaders.EXPIRES, EXPIRE_IN_SECONDS);
response.setHeader(HttpHeaders.CACHE_CONTROL, "max-age=" + EXPIRE_IN_SECONDS);
String json = new ObjectMapper().writeValueAsString(getDirectories());
response.getWriter().write(json);
}
}

Example 2: StoresServlet.Java doGet Servlet Implementation (json extension):
This is an example how a servlet in AEM to retrieve the stores JSON data.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

// example for /content/mysite.stores.json
@SlingServlet(
resourceTypes = "/apps/mysite/components/page/basepage",
selectors = "stores",
extensions = "json",
methods = "GET")
public class MyServlet extends SlingSafeMethodsServlet {
@Override
protected void doGet(SlingHttpServletRequest request, SlingHttpServletResponse response) throws ServletException, IOException {
response.setStatus(HttpStatus.OK_200);
response.setContentType(APPLICATION_JSON_UTF8);
response.setHeader(HttpHeaders.EXPIRES, EXPIRE_IN_SECONDS);
response.setHeader(HttpHeaders.CACHE_CONTROL, "max-age=" + EXPIRE_IN_SECONDS);
String json = new ObjectMapper().writeValueAsString(getStores());
response.getWriter().write(json);
}
}

JSON Request:
Typically, multi-channel implementations such as mobile, smartwatches, kiosks, 3rd party websites, etc… will be requesting for JSON data with the path of:

1 2	/content/mysite.directories.html /content/mysite.stores.json

As you can tell, the path stated above looks unfinished. In such, Sling Servlet Resolver scripts/paths may not be acceptable to present to the end-users. Revealing custom selectors or custom extensions are not suitable for security reasons and detailed information exposure; this can be easily resolved. We can add a layer of security, and also sugar-coat the revealed scripts/paths by utilising the Apache Web Server’s Rewrite Flag, PT, as one of the many good practises to follow.

What is the Apache Web Server’s Rewrite Flag, PT

The [PT] flag causes the result of the RewriteRule to be passed back through URL mapping as an Alias. Simply the end-users will only see an alias of the JSON file while the request is internally mapped to the correct path to the AEM publisher.

Examples of PT:

1 2	RewriteRule ^/api/directories.json$ /content/mysite.directories.html [PT,L] RewriteRule ^/api/stores.json$ /content/mysite.stores.json [PT,L]

Finally, after the Rewrite rule has been set up, multi-channel implementations can request for the JSON with this path:

1 2	/api/directories.json /api/stores.json

In summary, this is a standard way to secure your Servlets in AEM, and also to sugar-coat an AEM site’s Sling Servlet Resolver scripts/paths.

Also, do remember to add caching strategies for optimize the load against your AEM production publish instances.

The post Sugar Coat Registered AEM Servlet Scripts and Paths Endpoint appeared first on Sourced Code.

What is the AEM Apache Sling Referrer Filter OSGI configuration?

briankasingli — Sun, 01 Apr 2018 14:09:51 +0000

AEM “referrer not allowed”

Out of the box, AEM denies all server names or hosts to make HTTP request to the respective running AEM publish/author instance. During a HTTP request made to the AEM publish/author, AEM checks the Referrer header configuration. If the referrer configured to allow the host(s), then AEM will full-fill the request, and if not, the AEM “referrer not allowed” error message will be shown.

Take an example of an AEM application exposes an servlet that exposes the endpoint of “/bin/stores.js”. This endpoint will return an array of store detail JSON objects. This feature will be reusable, so throughout the AEM application, on many occasions, the endpoint is being used to render HTML elements to the page using javascript. Now take an example of a microsite within the same organisation of m.site.com (mobile site) where it would like to consume “/bin/stores.js”. When the micro-site make a HTTP GET request on “/bin/stores.js”, you will get the AEM “referrer not allowed” error because the host (or m.site.com) referrer is not allowed; we must allow m.site.com in the Apache Sling Referrer Filter settings.

What is an “HTTP Referrer header”? The HTTP Referrer header identifies the address of the webpage who’s making a request. We can use this information to allow specific hosts to fulfill the HTTP request.

Read More: https://en.wikipedia.org/wiki/HTTP_referer

In OSGI Configurations in AEM (http://localhost:4502/system/console/configMgr) use the browser finder (CTRL + F) and find “Apache Sling Referrer Filter”. Click on the configuration, and let’s break it down to see what fields control what.

Breaking things down

Allow Empty (Boolean): only enable this if you are testing (using a REST Client). Enabling this will allow any hosts to make requests to your AEM application (remember to turn this off in your production environment).
Allow Hosts (String[]): allows specific hosts to make requests to your AEM instance; use string characters only.
Allow Regexp Host (String[]): allows specific hosts to make requests your AEM instance; use regex only.
Filter Methods (String[]): defines which HTTP method(s) will be checked with the values in the allowed hosts before accepting incoming HTTP requests.

Quick Note:
If you are learn by doing, you can follow the “How to make a simple HTTP post request in AEM” tutorial blog, where this tutorial will put the AEM Apache Sling Referrer Filter OSGI configuration in practice. https://sourcedcode.com/how-to-make-simple-http-post-methods-in-aem-with-a-http-rest-client.

The post What is the AEM Apache Sling Referrer Filter OSGI configuration? appeared first on Sourced Code.

How to make a simple HTTP POST request to AEM with a HTTP Rest Client, Postman

briankasingli — Sat, 31 Mar 2018 14:27:04 +0000

This method should be used for DEVELOPMENT PURPOSES ONLY!

During development in the AEM author instance, you would like to test your servlet using an HTTP Rest Client such as Postman. When making a POST request on the Rest Client, you will experience 2 errors. An authentication error, and a 403 forbidden error.

What’s Happening?

Firstly, a typical development approach, you will be working on your author developers instance. Your Rest Client is making a POST request on the author instance, http://localhost:4502. You will get an authentication error.

Secondly, your POST request is being filtered and restricted by the “Apache Sling Referrer Filter” and “Adobe Granite CSRF Filter”. By default, the Apache Sling Referrer Filter blocks any incoming POST requests, and the Adobe Granite CSRF Filter blocks any incoming POST requests without the CSRF-Token token in the header.

How to solve this?

We can solve this issue by including basic auth type in Postman, then allowing incoming POST request in the Apache Sling Referrer Filter OSGI configurations, and remove the requirement of the CSRF-Token in the Adobe Granite CSRF Filter OSGI configurations.

Resource – Simple Servlet – https://gist.github.com/sourcedcode/bd1a2c150fabfc4b37857be0f389ac8a#file-simplepostservlet-java

Step 1 : Configure Basic Auth in Postman

Launch Postman, then navigate to the Authentication tab. Ensure type is set to “Basic Auth”, and username and password are set to “admin”; this is the default username and password for the administrator user while developing on the author instance.

Step 2 : Configure Apache Sling Referrer Filter

Enable allow empty
Remove the POST method from filters

In OSGI configurations (http://localhost:4502/system/console/configMgr), locate “Apache Sling Referrer Filter”. Enable the allow empty property, and remove the post method from filters property.

Step 3 : Configure Adobe Granite CSRF Filter

Remove the POST method from filters

In OSGI configurations (http://localhost:4502/system/console/configMgr), locate “Adobe Granite CSRF Filter”. Remove the post method from filters property.

Final Notes

After making configurations to the two OSGI configurations, you should be able to make a POST request from your HTTP REST Client to your AEM instance.

For production, set Apache Sling Referrer Filter and Adobe Granite CSRF Filter settings back to default. Unless if you are giving access to other servers to make POST requests to your AEM application.

The post How to make a simple HTTP POST request to AEM with a HTTP Rest Client, Postman appeared first on Sourced Code.