[AEMaaCS] Issue with isMemberOf property

[nikolay-v-atanasov]

Hi all,

We have an issue with AC Tool on AEMaaCS. The issue is weird because we have the same scripts and same configurations for all AEM Cloud environments, but we only have the problem on PROD, i.e. the groups are created properly on AEM DEV and STAGE environments but they are broken on PROD.

The problem is that we create several external IMS user groups by AC Tool, and for these groups, we specify that Group A isMemberOf Group B. For example we specify that:
SKD-FLEETCARCONFIGURATOR.FLEETCCDOC-HQ-PUBLISHER is member of these three groups:

• SKD-FLEETCARCONFIGURATOR.FLEETCCDOC-CMS-HQ-PUBLISHER,
• SKD-FLEETCARCONFIGURATOR.FLEETCCDOC-DAM-HQ-PUBLISHER and
• SKD-FLEETCARCONFIGURATOR.FLEETCCDOC-GLOBAL-USERS

However, the FLEETCCDOC-HQ-PUBLISHER group is not created as a member of the groups above. Here is the code snippet

• SKD-FLEETCARCONFIGURATOR.FLEETCCDOC-HQ-PUBLISHER:
  - name: SKD-FLEETCARCONFIGURATOR.FLEETCCDOC-HQ-PUBLISHER
  externalId: "SKD-FLEETCARCONFIGURATOR.FLEETCCDOC-HQ-PUBLISHER;ims"
  isMemberOf: SKD-FLEETCARCONFIGURATOR.FLEETCCDOC-CMS-HQ-PUBLISHER,SKD-FLEETCARCONFIGURATOR.FLEETCCDOC-DAM-HQ-PUBLISHER,SKD-FLEETCARCONFIGURATOR.FLEETCCDOC-GLOBAL-USERS
  path: /home/groups/fleet`

The script is attached
new_fleet.yaml.txt

Additionally, we create a similar user group FLEETCARCONFIGURATOR.FLEETCCDOC-HQ-PUBLISHER (no SKD prefix) and everything is good for this group i.e. the groups is included as a member of listed groups.

• FLEETCARCONFIGURATOR.FLEETCCDOC-HQ-PUBLISHER:
  - name: FLEETCARCONFIGURATOR.FLEETCCDOC-HQ-PUBLISHER
  path: /home/groups/fleet
  isMemberOf: FLEETCARCONFIGURATOR.FLEETCCDOC-CMS-HQ-PUBLISHER,FLEETCARCONFIGURATOR.FLEETCCDOC-DAM-HQ-PUBLISHER,FLEETCARCONFIGURATOR.FLEETCCDOC-GLOBAL-USERS

We have just one AC Tool configuration for PROD in config.author.prod folder. The PID of the service is biz.netcentric.cq.tools.actool.impl.AcInstallationServiceImpl.cfg.json
{ "configurationRootPaths":[ "/apps/xxx/actoolconfig", "/apps/xxx/actoolconfig_ims" ] }

I appreciate any advice and suggestion about the issue.

Thank you in advance,
Nikolay

[otarsko]

Hi @nikolay-v-atanasov what does AC Tool log say? I assume the execution on Production is successful? Maybe you can share the verbose log?

Additionally, we create a similar user group FLEETCARCONFIGURATOR.FLEETCCDOC-HQ-PUBLISHER (no SKD prefix) and everything is good for this group i.e. the groups is included as a member of listed groups.

Was it being created as part of the same yaml definition you shared? (asking, because don't see it there).

[nikolay-v-atanasov]

Hi,

I don't see errors in verbose log. The log is attached
ac_tool_verbole.log

The FLEETCARCONFIGURATOR.FLEETCCDOC-HQ-PUBLISHER (no SKD prefix) is created in another script file. The definition is here:
new_fleet.yaml.txt

I attached two screenshots on SKD and NOS SKD groups so we can see that NOT SKD groups are created successfully:

[nikolay-v-atanasov]

I dumped the AC Tool, and I see that for not SKD groups, we have

• STARGATE.STARGATE-EN-IE-IMPORTER:

   - name: 
     isMemberOf: STARGATE.STARGATE-GLOBAL-WORKFLOW-USERS,STARGATE.STARGATE-GLOBAL-WORKFLOW-REQUESTERS
     path: /home/groups/stargate/importers
  

and some of the comma-separated strings are converted to lists:

• FLEETCARCONFIGURATOR.FLEETCCDOC-CZ-EDITOR:

  • name:
    isMemberOf:
    • FLEETCARCONFIGURATOR.FLEETCCDOC-CS-CZ-CMS-EDITOR
    • FLEETCARCONFIGURATOR.FLEETCCDOC-EN-CZ-CMS-EDITOR
    • FLEETCARCONFIGURATOR.FLEETCCDOC-GLOBAL-USERS
    • FLEETCARCONFIGURATOR.FLEETCCDOC-CS-CZ-DAM-EDITOR
    • FLEETCARCONFIGURATOR.FLEETCCDOC-EN-CZ-DAM-EDITOR

Do we have a limitation of the length of isMemberOf property in characters?
Do we have any other limitation that affects converting isMemberOf property to YAML list?

Thank you
Nikolay

[kwin]

This doesn't seem to be like an issue in the tool itself (as it happens only on PROD), can you therefore please rather use https://github.com/Netcentric/accesscontroltool/discussions. This is reserved for tracking of bugs/features. Thanks.

[nikolay-v-atanasov]

The tool doesn't work as expected. This can be an environment-specific issue, can't it?

[kwin]

This can be an environment-specific issue, can't it?

Sure, but we don't know yet whether that is an issue with the tool or rather with the surroundings (e.g. incomplete index, ...)

[nikolay-v-atanasov]

Hi @kwin

I consider that this is a bug. I managed to reproduce on STAGE environment. I deleted all groups and regenerated them using AC Tool console. After the regeneration, the SKD-FLEETCARCONFIGURATOR.FLEETCCDOC-CMS-HQ-PUBLISHER,
SKD-FLEETCARCONFIGURATOR.FLEETCCDOC-DAM-HQ-PUBLISHER and
SKD-FLEETCARCONFIGURATOR.FLEETCCDOC-GLOBAL-USERS are empty i.e. there is no group included as a member of them.

Additionally, I delete all groups and start the pipeline. The AC tool reported that 286 groups were created:

However, no group exists i.e. all SKD groups are missing.

[kwin]

Can you add a minimal package which allows me to reproduce or point me to the code in AC Tool which you consider wrong? Otherwise I fear it will be impossible for anyone to fix the bug.

[ghenzler]

I just retested on a cloud service environment with latest version 2024.4.15787.20240404T134829Z installed and it works fine using the attached package
link-ims-groups-with-actool-example.zip. It comes with two simple configs for an AEM role group and how you link it to an IMS group. To avoid the need for a deployment the sample config is at /etc/actool-test in the mutable part of the repo (ok for quick tests - your actual config should be under /apps). For the IMS case it is recommended to just reference the IMS groups via members instead of reinstalling the IMS groups via explicit entries with externalId.

[ghenzler]

Further tests of @nikolay-v-atanasov and the team showed that

• generally using externalId works (as alternative to more simple approach outlined in last comment, can be useful if you have many groups > 50), however using isMemberOf between groups with externalId (if both sides of the relationships are external groups), most likely related to https://issues.apache.org/jira/browse/OAK-10486
• If you do not use the members approach from comment above and include the IMS groups in the config, make sure you do not link the IMS groups but rather create an IMS-independent role system and then create the IMS groups with isMemberOf for each IMS-independent role

[kwin]

https://issues.apache.org/jira/browse/OAK-10486 is supposably fixed in Oak 1.60.0 which is included in AEMaaCS since version 2024-03 (https://experienceleague.adobe.com/en/docs/experience-manager-cloud-service/content/release-notes/maintenance/2024/2024-3-0#embedded-tech-15262)

[ghenzler]

I think they were on an older version

[nikolay-v-atanasov]

The issue is available with AEMaaCS SDK 2024-03 and 2024-04 versions. We tested with old SDK version from 2023-12 and we couldn't reproduce the issue.