Install the required Feature Packs.
Last updated on
Dec 16, 2024
Applies to enterprise.
Learn how to enable users to access AEM Assets within their Creative Cloud tools.
If you're a creative professional or marketer, use Adobe Asset Link from within your Creative Cloud desktop apps to streamline collaboration while you create content.
Connect with Adobe Experience Manager Assets through the Adobe Asset Link panel in your familiar apps: Adobe InDesign, Photoshop, Illustrator, and XD. Access and modify content stored in Experience Manager Assets without exiting the Creative Cloud apps.
As the AEM admin of your organization, you can enable your creative users to do the following using Adobe Asset Link.
Configure your AEM Assets instance
Ensure that you have set up users and a user group in the Admin Console, and you have the following information handy.
- Organization ID- The ID of your organization in the Admin Console (For example, 1E9D9F8157D861BC7F000101@AdobeOrg).
- User group name- Name of the user group that you want to assign permissions to access Adobe Asset Link.
It is recommended that you back up your AEM Assets instance before you begin. Configuring an AEM instance to work with Adobe Asset Link has the following high-level steps:
Note
Ensure that you have the administrative access to an AEM instance.
Configure AEM authentication modules to support SSO with Adobe sign-in.
To ensure good performance with Adobe Asset Link, fine-tune AEM Query Indexes.
1. Install the Feature Pack
Ensure that you have administrative access to a running AEM instance. If you want to start from scratch, follow AEM documentation on installation and basic configuration. The IMS Feature Pack allows Creative Cloud users with Enterprise IDs and Federated IDs to sign in to AEM from Adobe Asset Link, using IMS.
It is recommended to install the latest Service Pack and Cumulative Fix Pack before installing the Feature Pack.
2. Configure AEM authentication modules
Configuration is required on the AEM side to allow Creative Cloud Users with enterprise IDs and Federated IDs to connect to the AEM Assets.
Note
These instructions assume that you are using supporting configuration packages for your respective AEM version. To configure or modify an existing AEM instance from scratch, see AEM Assets Configuration - Manual Configuration Instructions.
Install configuration package
Download the configuration package and install it on the AEM instance using the Package Manager (/crx/packmgr/index.jsp). This package can be used as an alternative to parts of the manual configuration.
Configure your AEM Assets instance
AEM configuration is done within the AEM Web Console. It is available within the AEM web user interface under Tools > Operations > Web Console, and then OSGi > Configuration. The URL has the following path and shows a list of configurations.
/system/console/configMgr
Note
If a configuration has more properties than listed here, do not change those fields.
In the AEM Web Console Configuration, find the Adobe Granite OAuth IMS Provider Extension configuration and click 
to edit it. Set the following configuration properties as indicated, and click Save.
|
Property Name |
Value |
|---|---|
|
Organization |
Enter the organization ID as in the Admin Console. |
|
Group Mapping |
Set as indicated in the Group Mapping section |
To manually configure the AEM Assets instance, do the following:
Find the Adobe Granite OAuth IMS Provider configuration and click to edit it.
Set the following configuration properties as indicated, and click Save.
|
Property Name |
Value |
|---|---|
|
Authorization Endpoint |
https://ims-na1.adobelogin.com/ims/authorize/v1 |
|
Profile Endpoint |
https://ims-na1.adobelogin.com/ims/profile/v1 |
|
Token Endpoint |
https://ims-na1.adobelogin.com/ims/token/v1 |
|
Validation URL |
https://ims-na1.adobelogin.com/ims/validate_token/v1 |
|
Extended Details URLs |
https://ims-na1.adobelogin.com/ims/organizations/v1 |
Find the Adobe Granite OAuth IMS Provider Extension configuration and click to edit it.
Set the following configuration properties as indicated, and click Save.
|
Property Name |
Value |
|---|---|
|
Organization |
Enter the organization ID as in the Admin Console. |
|
Group Mapping |
Set as indicated in the Group Mapping section |
Find the Adobe Granite Bearer Authentication Handler configuration and click to edit it.
Set the following configuration properties as indicated. To add the Client IDs listed, use the + button to add the new text fields. Click Save.
|
Property Name |
Value |
|---|---|
|
Allowed OAuth client ids |
|
Each request authenticated with a bearer token incurs the overhead of three calls to IMS, user syncing, and the creation of a login-token in AEM. To overcome this overhead, Adobe Asset Link captures the login-token returned in the response from AEM and sends it with subsequent requests. For this process to work, the relative priority of the bearer authentication handler must be adjusted.
To change the handler ranking, edit the configuration file in the AEM installation folder under the following config file and restart the AEM instance afterwards.
crx-quickstart/launchpad/config /com/adobe/granite/auth/oauth/impl/BearerAuthenticationHandler.config
Or, follow the steps below:
In a browser, open CRXDE by going to /crx/de/index.jsp and sign in as admin.
Navigate to /apps/system/config, locate the following file, and double-click it to open that configuration in the editor window on the right side.
- com.adobe.granite.auth.oauth.impl.BearerAuthenticationHandler.config
Go to the bottom of the file and add the following line:
- service.ranking=I"-10"
Click Save All in the upper left corner of the browser window or press Command/Ctrl-S.
Group Mapping
To access AEM Assets, Adobe Asset Link users must have a user profile created on the AEM server and have that profile added to an AEM user group with the proper permissions. A user profile is automatically created when an authenticated Adobe Asset Link user first accesses AEM. Group mappings are used to control how Adobe Asset Link users are assigned to user groups on the AEM server. Each mapping associates a group in the Admin Console, also known as an Adobe IMS group, with a group in AEM. Each explicitly defined group mapping is a configuration setting that takes the following form:
<imsGroupName>=<aemGroupID> or <imsGroupName>:<imsGroupRole>=<aemGroupID>
In AEM 6.2, group mappings must be explicitly configured to associated groups in IMS with groups in AEM. For example, if a user is a member of an IMS group called assetlink-users then the following mapping can be used to add any member of that group to the predefined dam-users group in AEM to give them access to AEM Assets:
assetlink-users=dam-users
The following rules apply to group mappings:
- If a user is a member of an IMS group within the defined organization that matches the left side of the mapping, they are added as a member of the AEM group on the right side.
- If the imsGroupRole is specified, then both the user’s membership and role in the IMS group must match in order for the user to be added to the AEM group on the right side.
- If a user is added to or removed from an IMS group, or if any mappings change, AEM updates the group memberships in AEM according to the current mappings. The update is made for each user the next time the user makes a request to the AEM server using Adobe Asset Link after the AEM authentication token has expired. This update can be forced by closing and reopening the Adobe Asset Link Panel.
- The AEM group specified on the right side of a mapping must exist in the AEM instance in order for the mapping to be successful. It is not automatically created.
- A wildcard can be used to add all users to an AEM group. For example, *=dam-users adds all authenticated users to the dam-users group in AEM. (Not recommended in a production environment.)
- If a user is not a member of the configured organization or if none of the mappings are matching, the user is created in AEM and assigned to the group everyone. (Does not give the user any access rights.)
3. Fine-tune Query indexes
AEM contains indexes which are used for efficient queries. Many of these indexes are provided in the base product, but there are situations when a project-specific query needs a custom index. Adobe Asset Link requires two custom indexes for its efficient operation, particularly in production or sample settings with many assets or many users. These indexes are recommended but not required for "localhost"/demo instances with a light load and a relatively small number of assets. The following instructions describe how to create those indexes.
Both of these indexes are set up as a Property index. The alternative, which has already been explored, is to use a Lucene index. While a Lucene index has many advantages, it is asynchronous in nature and there is a duration (potentially minutes) in which a newly created node such as a user profile, does not appear in a query with a Lucene index. Because this scenario has been seen in testing and creates a significant impact (such as "duplicate" user profiles), the synchronous Property index must be used.
This index is used by the "My Checked Out Assets" query.
In a browser, open CRXDXDE by going to /crx/de/index.jsp and sign in as admin.
Locate the node at /oak:index, right-click on it and select Create > Create Node.
Name the node cqDrivelock and set the Type to oak:QueryIndexDefinition.
Add the following properties to the new node:
- Name: type; Type: string; Value: property
- Name: propertyNames; Type: Name[] (click the "Multi" button); Value: cq:drivelock
Click the Save All button.
This index is used when authenticating any request with a Bearer token.
In a browser, open CRXDE by going to /crx/de/index.jsp and sign in as admin.
Locate the node at /oak:index, right-click on it and select Create > Create Node.
Name the node oauthid and set the Type to oak:QueryIndexDefinition.
Add following properties to the new node:
- Name: type; Type: string; Value: property
- Name: propertyNames; Type: Name[] (click the Multi button); Value: oauthid- (Note the hyphen.)
Click the Save All button.
The AEM configuration for Adobe Asset Link is complete.
To learn how creatives can use the Adobe Asset Link panel, see Manage assets using the Adobe Asset Link panel.
