How to change permissions for Runnable class in Adobe AEM?

Question

AI have a problem with accessing resources from within my Runnable class.

I am implementing the Runnable component in AEM (v.6.5). It needs to access the resource, in this case, it is '/libs/wcm/core/resources/languages'. However, this resource is not accessible for anonymous user and AEM starts my component with such user.

How I can change the user inside my Runnable class so it is run with different permissions?

Thanks in advance for help.

org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.my-service-user.xml :

<?xml version="1.0" encoding="UTF-8"?>
    <jcr:root xmlns:sling="http://sling.apache.org/jcr/sling/1.0" xmlns:jcr="http://www.jcp.org/jcr/1.0"
        jcr:primaryType="sling:OsgiConfig"
        user.mapping="[xxx.yyy.my-app.core:my-service=[my-service-system-user]]"/>

Getting the Reosurce:

resourceResolver = resolverFactory.getServiceResourceResolver(Collections.singletonMap(ResourceResolverFactory.SUBSERVICE, "my-service"));

I read some documentation but it is just not working in my case.

I am at the very beginning of my AEM 'adventure' so maybe I just understand something :)

As I understand, I need a 'system user'. I don't want to be dependent on 'acs-aem-commons'. I was trying this blog article . I created the user manually, then created the config file and remove user from the system. It is not being recreated.

Answer 1

If I understand correctly, you're trying to use the Sling Scheduler to run a scheduled task.

In terms of repository access, this isn't much different from any other OSGi service. Any content that's not accessible by anonymous users should be loaded using a dedicated service user with the minimal set of permissions that makes sense. That way, you can add explicit, read-only access to a given set of resources and limit it to a specific OSGi service instead of making parts of the repository publicly readable.

To do this, you can create a service user mapping so that your bundle can use the service user account. That will allow you to use ResourceResolverFactory#getServiceResourceResolver to instantiate a resource resolver associated with a session created in that user's name.

See https://sling.apache.org/documentation/the-sling-engine/service-authentication.html for more information.