Assets capability
Last updated on
Aug 3, 2026
Learn how to configure Adobe Experience Manager (AEM) Assets for use with the Adobe Asset Link (AAL) extension for Creative Cloud apps.
Adobe Asset Link streamlines collaboration between creatives and marketers during content creation. It connects Adobe Experience Manager Assets with the Creative Cloud desktop apps Adobe InDesign, Photoshop, and Illustrator, so creatives can access and modify content stored in AEM Assets without leaving the apps they know.
Note
If you use Experience Manager Assets as a Cloud Service, see Configure Experience Manager Assets as a Cloud Service for Adobe Asset Link instead.
To configure AEM Assets for Asset Link, use an AEM administrator account and complete these tasks:
- Install packages as required.
- Configure AEM manually or using a configuration package.
- Manage user access control to map Creative Cloud-licensed users with AEM users.
- Create a custom query index, configure FPO renditions for InDesign, configure Adobe Stock integration, and configure visual or similarity search.
Prerequisites and support for various functionalities
Install the appropriate service pack and package as needed. The following table lists the requirements for each AEM version and capability.
|
|
AEM version and requirements for support |
|
Asset Link works by default |
AEM 6.5 and 6.5.2 or later, and AEM 6.4.4 and 6.4.6 or later. Adobe recommends installing the latest AEM service pack before using Asset Link. |
|
Asset Link works after installing a package |
For AEM 6.4.0 to 6.4.3, install the adobe-asset-link-support package. |
|
Adobe Stock integration |
AEM 6.4.2 or later. |
|
Visual or similarity search |
AEM 6.5.0 or later. |
Configure Experience Manager using the configuration package
Adobe recommends installing the adobe-asset-link-config configuration package to automate most configuration tasks, followed by a few manual tasks. Alternatively, configure AEM manually (see the next section).
Caution
If your AEM instance is configured for user login with Adobe IMS accounts, do not use the configuration package. Configure AEM manually instead.
In the AEM web interface, go to Tools > Deployment > Package Share to open Package Manager, then install the adobe-asset-link-config package.
Go to Tools > Operations > Web Console. Locate the Adobe Granite OAuth IMS Provider configuration, select the Edit icon, set the following properties, and save:
|
Property |
Value |
|
Group Mappings |
Leave empty unless needed. For details, see Group Mapping. |
|
Organization |
Enter the organization ID from the Adobe Admin Console (the value ending in @AdobeOrg). |
Locate the Adobe Granite Bearer Authentication Handler configuration, select the Edit icon, and add InDesignAem2 to the Allowed OAuth client IDs property.
To access the configuration manager, access Tools > Operations > Web Console. Select OSGi > Configuration from the menu at the top.
Locate the Adobe Granite OAuth IMS Provider configuration and select the Edit 
icon. Set the following configuration and save.
|
Property |
Value |
|
Authorization Endpoint |
https://ims-na1.adobelogin.com/ims/authorize/v1 |
|
Token Endpoint |
https://ims-na1.adobelogin.com/ims/token/v1 |
|
Profile Endpoint |
https://ims-na1.adobelogin.com/ims/profile/v1 |
|
Validation URL |
https://ims-na1.adobelogin.com/ims/validate_token/v1 |
|
Organization |
The organization ID from the Adobe Admin Console. |
|
Group Mappings |
Leave empty unless you have a special case. For details, see Group Mapping. |
Locate the Adobe Granite Bearer Authentication Handler configuration, select the Edit icon, and add the following client IDs to the Allowed OAuth client ids property. Select the Add icon to add each ID, then save:
- InDesignAem2
- cc-europa-desktop_0_1
- cc-europa-desktop_1_0
- cc-europa-desktop_2_0
- cc-europa-desktop_3_0
- cc-europa-desktop_4_0
- cc-europa-desktop_5_0
- cc-europa-desktop_6_0
- cc-europa-desktop_7_0
- cc-europa-desktop_8_0
- cc-europa-desktop_9_0
- cc-europa-desktop_10_0
In the Adobe Granite OAuth Application and Provider configuration, inspect the existing Adobe Granite OAuth Authentication Handler instances. If an instance has the Config ID value ims, use it. Otherwise, select the Add icon to create one. Set the following and save:
|
Property |
Value |
|
Client ID |
Do not change. |
|
Client Secret |
Do not change. |
|
Config ID |
ims |
|
Scope |
AdobeID, OpenID, read_organizations (other values may also be present). |
|
Provider ID |
ims |
|
Create users |
Checked (true). |
|
User ID Property |
Email for a newly created configuration. Otherwise, do not change. |
Locate the Apache Jackrabbit Oak Default Sync Handler configuration with the Sync Handler Name ims, select the edit icon, set the following, and save:
|
Property |
Value |
|
User Expiration Time and User Membership Expiration |
Time in minutes followed by 'm' with no space, for example, 15m for fifteen minutes. For details, see Group Mapping. |
|
User auto membership |
Do not change. |
|
User Dynamic Membership |
Deselected (false). |
Locate the Adobe Granite OAuth Authentication Handler configuration, select the Edit icon, and select Save without making changes.
Adjust the relative priority of the bearer authentication handler. In CRXDE, go to /apps/system/config. Locate com.adobe.granite.auth.oauth.impl.BearerAuthenticationHandler.config and open it. Add service.ranking="-10" at the end, and save.
Note
Each request authenticated with a bearer token incurs the overhead of three calls to Adobe IMS, user syncing, and creation of a login-token in AEM. To reduce this overhead, Adobe Asset Link captures the login-token returned by AEM and sends it with later requests. For this to work, the relative priority of the bearer authentication handler must be adjusted.
(Optional) If AEM users have uppercase or mixed case domain names in their email IDs, select Change Locking User to Lower Case in Adobe Granite ACP Platform Configs in AEM Web Console.
Additional configuration after migration to Business Profiles
Adobe Asset Link users connect to Experience Manager to allow IMS login from the main Creative Cloud for enterprise (CCE) organization. Experience Manager uses the client IDs to identify the permitted IMS organization. After migration to Business Profiles, configure the Client ID and Secret Key for the IMS organization in Experience Manager for the Bearer Authentication Handler. For more on Business Profiles, see Introducing Adobe Profiles.
This additional configuration is required only if you use different Adobe IMS organizations for Experience Manager and CCE and have established a domain trust relationship between them.
Note
The fix for Business Profiles is provided in Experience Manager 6.5.11.0, with an extended fix in Experience Manager 6.4.8.4. The existing configuration continues to work if you use the same Adobe IMS organization for Experience Manager and CCE.
Prerequisites
- A running Experience Manager instance with Bearer Authentication configured for Asset Link.
- If you are on Experience Manager 6.4, upgrade to Experience Manager 6.4.8.4. If you are on Experience Manager 6.5, upgrade to Experience Manager 6.5.11.0.
- (Only for Experience Manager 6.4) Contact Customer Support to get the extended fix pack (EFP) for migration to Business Profiles, and install it on your Experience Manager instance.
- Contact Customer Support to get the Client ID and Secret Key for Bearer Authentication of your IMS organization.
Then complete the following additional configurations:
- In Adobe Granite OAuth IMS Configuration Provider, set the OAuth Configuration ID (oauth.configmanager.ims.configid) to ims (verify, you may already have it), and set the IMS Owning Entity (ims.owningEntity) to your IMS organization ID.
- Open the Bearer Authentication Handler configuration and add the Client ID obtained from Customer Support to the Allowed OAuth client ids list.
- Open the Adobe Granite OAuth Application and Provider configuration and add the Client ID and Client Secret (Secret Key) obtained from Customer Support. Ensure the Config ID field (oauth.config.id) matches the OAuth Configuration ID (oauth.configmanager.ims.configid) set above.
- Open the Adobe Granite IMS Cluster Exchange Token Preprocessor configuration and enable it.
For more information, see additional configuration in Experience Manager 6.4 and Experience Manager 6.5.
Manage user access control on the AEM repository
This section describes how to manage users and their access to the AEM repository.
Group mapping
Group mapping determines how groups in AEM correspond to groups in Adobe IMS. It plays an important role in how Adobe Asset Link users are granted permission to access AEM Assets.
When used with Adobe Asset Link, AEM delegates user management to Adobe IMS. AEM automatically creates users and groups that correspond to those in Adobe IMS, and synchronizes users, groups, and group membership to match Adobe IMS.
For example, if Adobe Asset Link users are members of the Adobe IMS group assetlink-users, a synchronized group named assetlink-users is created in AEM when a user from that IMS group connects to Adobe Asset Link for the first time. Each new user in the IMS group is added to the corresponding AEM group when they first connect to AEM through Adobe Asset Link.
Groups in AEM that correspond to and synchronize with IMS groups can be granted access directly or by making them members of another AEM group.
The following rules apply to group mappings in AEM:
- Ensure the Group Mappings property in the Adobe Granite OAuth IMS Provider configuration is blank.
- Adobe Asset Link user group membership is evaluated when the user authenticates and after the period in the User Expiration Time property (Apache Jackrabbit Oak Default Sync Handler configuration) elapses. Users can be added to and removed from AEM groups to synchronize with Adobe IMS.
- Avoid group name conflicts. Ensure the names of IMS groups (used to manage users) differ from all AEM system group names, for example, the dam-users group and groups created by the AEM administrator. An IMS group whose name conflicts with an AEM system or manually created group is not used to control permissions.
- If an IMS user connects to an AEM instance where the user's name conflicts with a previously created AEM user, the IMS user is given another name with numbers appended to make it unique.
Set up first-time access control
Users who connect through Adobe Asset Link can view and interact with assets only after they are granted the required permission. Adobe recommends that AEM administrators use the synced groups (described in Group mapping) to manage access control for Adobe Asset Link users. For each AEM group synchronized with an IMS group:
Ensure the group has a member who can be used to establish an initial connection via Adobe Asset Link.
Use that user to sign in to Adobe Asset Link and connect to AEM. This connection is expected to fail.
In AEM, locate the group corresponding to the IMS group and grant it the desired access controls. For example, make the new group a member of the dam-users group.
Close Adobe Asset Link and restart the Creative Cloud application.
Reopen Adobe Asset Link to verify that the user has the expected access.
After these steps, other users in the same group can connect to AEM with Adobe Asset Link on their first attempt, with the same permissions as the other users in the group.
Manage AEM users to work with Adobe Asset Link
Adobe Asset Link users connect to AEM when signed in to their Creative Cloud application. This authentication uses Adobe IMS and creates user information in AEM if it does not already exist. AEM enterprise customers often manage users with an external identity provider integrated with AEM (Adobe IMS, or products that use SAML and LDAP), or manage users locally in AEM.
Users who connect to AEM from Adobe Asset Link have no conflict with existing AEM user information from a previous direct sign-in if:
- All user names for direct sign-in to AEM differ from the user names used in Adobe IMS for Creative Cloud sign-in, or
- Adobe IMS is the identity provider for direct AEM sign-in, or
- The user connects to AEM from Adobe Asset Link before signing in to AEM directly with the same account.
User information created by direct AEM sign-in must be updated to work with Adobe Asset Link in these scenarios:
- The same username (such as the user's email address) is used for both the Creative Cloud account (which uses Adobe IMS) and an account with an external identity provider other than Adobe IMS.
- The same user name is used for both the Creative Cloud account and a local AEM account.
- The Creative Cloud accounts in Adobe IMS are Federated IDs served by the same external identity provider integrated with AEM for direct sign-in.
AEM users created in these scenarios lack a property required for users synchronized with Adobe IMS. To update such users:
In the AEM web console, locate the Apache Jackrabbit Oak External PrincipalConfiguration configuration, select the Edit icon, deselect the External Identity Protection checkbox, and select Save.
To open the AEM User Management interface, go to Tools > Security > Users. Select the user to update, then note the end of the browser URL path starting with /home/users. You can also search for the user name in AEM CRXDE. The user path looks like /home/users/x/xTac082TDh-guJzzG7WM..
In CRXDE, go to the user path, select the user node, and view its properties on the Properties tab (this node has a jcr:primaryType value of rep:User).
At the bottom of the Properties tab, add a Name of rep:externalId, a Type of String, and a Value of <rep:authorizableId>;ims, where <rep:authorizableId> is the value of the node's rep:authorizableId property. Use a semicolon with no spaces to separate the value from ims.
Select Add to the right of your new entry, then select Save All.
Repeat steps 2 to 5 for any other users you want to update.
In the AEM web console, locate the Apache Jackrabbit Oak External PrincipalConfiguration configuration, select the edit icon, deselect the External Identity Protection checkbox, and select Save.
Note
If the services are not restored within a few minutes, restart AEM to allow successful authentications.
After this change, an updated AEM user can connect to Adobe Asset Link and continue using the direct AEM sign-in method they used before. On successful authentication with Adobe IMS, the AEM user profile synchronizes with the Adobe IMS profile.
To perform a bulk migration of multiple AEM users to work with Adobe Asset Link, contact Adobe Care for assistance.
As an alternative, in certain cases, an Adobe Asset Link user can be granted quick access to AEM: the pre-existing user information is found and deleted in AEM User Management or CRXDE before their connection to Adobe Asset Link, and new user information is created after the connection. Use this approach only if you are certain that no important data is stored as a child of the user node. Extra data is any child node other than tokens, preferences, profile, profiles, profiles/public, and rep:policy/* nodes.
Auto-start a workflow to process assets conditionally
In Experience Manager 6.4 and 6.5, administrators can configure workflows to automatically run and process assets based on predefined conditions. This is useful, for example, for line-of-business users and marketers to watermark all assets from an agency photoshoot or to process all assets uploaded by a freelancer to create specific renditions.
For configuration details, see auto-execute a workflow on assets.
Generate for-placement-only (FPO) renditions for InDesign
When placing large assets from AEM into InDesign documents, a creative professional can wait a long time after placing an asset, and is blocked from using InDesign in the meantime. To avoid this, AEM can place a small for-placement-only (FPO) rendition first. When the final output is required, for example, for print and publishing, the original full-resolution asset replaces the temporary rendition in the background. This asynchronous update speeds up the design process without hindering the creative flow.
FPO renditions have a small file size but the same aspect ratio. If an FPO rendition is unavailable for an asset, InDesign uses the original asset instead, so the workflow continues without interruption.
Approaches to generate FPO renditions
AEM offers several methods for processing images and generating FPO renditions. The two most common are AEM's in-built workflows and ImageMagick. With either option, you can configure rendition generation for newly uploaded and existing assets. ImageMagick renditions are downsampled, that is, the pixel dimensions are proportionally reduced if the original has a PPI larger than 72. See install and configure ImageMagick to work with AEM Assets.
|
Using AEM's in-built workflow |
Using ImageMagick workflow |
Remarks |
|
|
For new assets |
Enable FPO rendition. |
Add an ImageMagick command line to the AEM workflow. |
AEM runs the DAM Update Asset workflow for every upload. |
|
For existing assets |
Enable FPO rendition in a new, dedicated AEM workflow. |
Add an ImageMagick command line to a new, dedicated AEM workflow. |
FPO renditions of existing assets can be created on demand or in bulk. |
Caution
Create the rendition workflows by modifying a copy of the default workflows. This prevents your changes from being overwritten when AEM is updated, for example when you install a new service pack.
Go to Tools > Workflow > Models. Select the DAM Update Asset model and select Edit.
Select the Process Thumbnails step and select Configure.
Select the FPO Rendition tab and select Enable FPO rendition creation.
Adjust the Quality and add or modify the Format List values as needed. By default, the MIME types for FPO rendition generation are pjpeg, jpeg, jpg, gif, png, x-png, and tiff. Select Done.
Note
Rendition generation is supported for JPEG, GIF, PNG, TIFF, PSD, and BMP files.
Select Sync to activate the changes.
Note
Images larger than 1280 pixels on one side do not retain the pixel dimensions in the FPO rendition.
Go to Tools > Workflow > Models. Select DAM Update Asset model and select Edit.
Select Toggle Side Panel in the upper left corner. Search for the command line step.
Drag the Command Line step and add it before the Process Thumbnails step.
Select Command Line step and select Configure.
Add a custom Title and Description, for example, FPO rendition (powered by ImageMagick).
On the Arguments tab, add relevant Mime Types to specify a list of file formats on which the command applies.
On the Arguments tab, in the Commands section, add an ImageMagick command to generate FPO renditions. The example below generates FPO renditions in JPEG format, downsampled to 72 PPI at 10% quality, and flattens multi-layered Photoshop files:
convert -quality 10% -units PixelsPerInch ${filename} -resample 72 -flatten cq5dam.fpo.jpeg
Select Sync to activate the changes.
For details on ImageMagick command-line capabilities, see imagemagick.org.
Generate renditions of existing assets using an AEM workflow
Create a dedicated workflow model that uses the built-in FPO rendition option:
In AEM, go to Tools > Workflow > Models. Select Create > Create Model, then add a meaningful title and name.
Select the model and select Edit. Select Page Information > Open Properties, select Transient Workflow (this improves scalability and performance), then save.
Select Toggle Side Panel and search for the process thumbnail step. Drag the Process Thumbnails step.
Select Process Thumbnails, then select Configure, and follow the configuration to generate renditions of new assets using an AEM workflow. Select Sync to activate the changes.
Generate renditions of existing assets using ImageMagick
Create a dedicated workflow model that uses the ImageMagick command line:
- Follow steps 1 to 3 to generate renditions of existing assets using an AEM workflow.
- Follow steps 4 to 8 to generate renditions of new assets using ImageMagick.
View FPO renditions
Check the generated FPO renditions after the workflow completes:
In the AEM Assets interface, select the asset to open a large preview. Open the left rail and select Renditions.
Select the FPO rendition to load its preview. Optionally, right-click the rendition to save it to your file system.
Tips and limitations
- To use ImageMagick-based configuration, install ImageMagick on the same machine as AEM.
- To generate FPO renditions for many assets or the entire repository, plan and run the workflows during low-traffic periods. Generating FPO renditions at scale is resource-intensive, and the AEM servers need sufficient processing power and memory.
- For performance and scalability, see fine-tune ImageMagick.
- For generic command-line handling of assets, see the command-line handler.
Create a custom index in AEM 6.4.x versions
AEM uses indexes for querying. Adobe Asset Link requires the following custom index to determine which assets a user has checked out. AEM 6.5.0 contains this index by default, so create it only on earlier versions.
- In CRXDE, locate the /oak:index node. Create a new node named cqDrivelock and set its Type to oak:QueryIndexDefinition.
- Add the following properties to the new node and save:
- Name: type; Type: string; Value: property
- Name: propertyNames; Type: Name[] (select the Multi button); Value: cq:drivelock
In CRXDE, locate the /oak:index node. Create a new node named cqDrivelock and set its Type to oak:QueryIndexDefinition.
Add the following properties to the new node and save:
Name: type; Type: string; Value: property
Name: propertyNames; Type: Name[] (select the Multi button); Value: cq:drivelock
Integrate with Adobe Stock
Organizations can integrate their Adobe Stock accounts with AEM Assets to make high-quality, royalty-free, licensed photos, vectors, illustrations, videos, templates, and 3D assets available for creative and marketing projects. Creative professionals can then use these assets through the Asset Link panel. To integrate, see Adobe Stock assets in AEM Assets. AEM 6.4.2 or later is required.
Configure visual or similarity search
Visual search lets you find visually similar assets in the AEM Assets repository from the Adobe Asset Link panel. It is available in AEM 6.5.0 or later, and only indexed assets are searched. For more information, see how to configure visual search.
Troubleshoot AEM-related issues
If you run into issues configuring or using Asset Link:
- Ensure your deployment meets the prerequisites and that the appropriate feature packs or packages are installed.
- Contact your organization's partner or system integrator.
- If Creative Cloud users cannot check in checked-out assets, the cause may be the casing of domain names in email addresses. To fix it, see Manually configure AEM.
- For more, see Troubleshoot Adobe Asset Link.
