> For AI agents: the complete documentation index is available at https://nhanbe.id.vn/llms.txt, the full documentation bundle is available at https://nhanbe.id.vn/llms-full.txt. # Touch UI Principal-Based Permission Management | title | Principal View for Permissions Management | | ------------ | ------------------------------------------------------------------------------- | | description | Learn about the new Touch UI interface that facilitates permissions management. | | contentOwner | sarchiz | | content-type | reference | | products | SG\_EXPERIENCEMANAGER/6.5/SITES | | topic-tags | Security | | docset | aem65 | | exl-id | 4ce19c95-32cb-4bb8-9d6f-a5bc08a3688d | | solution | Experience Manager, Experience Manager Sites | | feature | Security | | role | Admin | ## Principal View for Permissions Management ## Overview AEM 6.5 introduces Permissions Management for Users and Groups. The main functionality remains the same as the classic UI, but is more user-friendly and efficient. ## How to Use ### Accessing the UI The new UI-based permissions management is accessed through the Permissions card under Security as shown below: [![Permissions Management UI](/aem/articles/touch-ui-principal-view/permissions-management-ui.png)](https://github.com/AdobeDocs/experience-manager-65.en/blob/d4bc00353812d963d2318cd148c6dbbac6bb2334/help/sites-administering/assets/screen_shot_2019-03-17at63333pm.png) The new view makes it easier to look at the whole set of privileges and restrictions for a given principal at all paths where Permissions have been granted explicitly. This removes the need to go to CRXDE to manage advanced privileges and restrictions. It has been consolidated in the same view. The view defaults to the Group "everyone". [![View of "everyone" group](/aem/articles/touch-ui-principal-view/unu-1.png)](https://github.com/AdobeDocs/experience-manager-65.en/blob/d4bc00353812d963d2318cd148c6dbbac6bb2334/help/sites-administering/assets/unu-1.png) There is a filter that allows the user to select the type of principals to look at **Users**, **Groups**, or **All and search for any principal.** [![Search for types of Principals](/aem/articles/touch-ui-principal-view/search-for-types-of-principals.png)](https://github.com/AdobeDocs/experience-manager-65.en/blob/d4bc00353812d963d2318cd148c6dbbac6bb2334/help/sites-administering/assets/image2019-3-20_23-52-51.png) ### Viewing Permissions for a Principal The frame on the left allows users to scroll down to find any principal or search for a Group or a User based on the selected filter, as shown below: [![View Permissions for a Principal](/aem/articles/touch-ui-principal-view/doi-1.png)](https://github.com/AdobeDocs/experience-manager-65.en/blob/d4bc00353812d963d2318cd148c6dbbac6bb2334/help/sites-administering/assets/doi-1.png) Clicking the name shows the assigned permissions on the right. The permissions pane shows the list of Access Control Entries on specific paths along with configured restrictions. [![View ACL List](/aem/articles/touch-ui-principal-view/trei-1.png)](https://github.com/AdobeDocs/experience-manager-65.en/blob/d4bc00353812d963d2318cd148c6dbbac6bb2334/help/sites-administering/assets/trei-1.png) ### Adding new Access Control Entry for a Principal New permissions can be added by adding an Access Controlling Entry. Simply click the Add ACE button. [![Add new ACL for a Principal](/aem/articles/touch-ui-principal-view/patru.png)](https://github.com/AdobeDocs/experience-manager-65.en/blob/d4bc00353812d963d2318cd148c6dbbac6bb2334/help/sites-administering/assets/patru.png) This brings up the window shown below, the next step is to choose a path where the permission must be configured. [![Configure permissions path](/aem/articles/touch-ui-principal-view/cinci-1.png)](https://github.com/AdobeDocs/experience-manager-65.en/blob/d4bc00353812d963d2318cd148c6dbbac6bb2334/help/sites-administering/assets/cinci-1.png) Here, a path is selected where you can configure a permission for **dam-users**: [![Example configuration for dam-users](/aem/articles/touch-ui-principal-view/sase-1.png)](https://github.com/AdobeDocs/experience-manager-65.en/blob/d4bc00353812d963d2318cd148c6dbbac6bb2334/help/sites-administering/assets/sase-1.png) After the path is selected, the workflow goes back to this screen, where the user can then select one or more of the privileges from the available namespaces (like `jcr`, `rep` or `crx`) as shown i below. Privileges can be added by searching using the text field and then selecting from the list. > \[!note] Note > For a complete list of privileges and descriptions, see [User, Group, and Access Rights Administration](https://github.com/AdobeDocs/experience-manager-65.en/blob/d4bc00353812d963d2318cd148c6dbbac6bb2334/help/sites-administering/user-group-ac-admin.md#access-right-management). [![Search permission for a given path.](/aem/articles/touch-ui-principal-view/search-permission-for-a-given-path.png)](https://github.com/AdobeDocs/experience-manager-65.en/blob/d4bc00353812d963d2318cd148c6dbbac6bb2334/help/sites-administering/assets/image2019-3-21_0-5-47.png) [![Add New Entry for 'dam-users' as shown by a path selected in vertical columns.](/aem/articles/touch-ui-principal-view/add-new-entry-for-dam-users-as-shown-by-a-path-selected-in-v.png)](https://github.com/AdobeDocs/experience-manager-65.en/blob/d4bc00353812d963d2318cd148c6dbbac6bb2334/help/sites-administering/assets/image2019-3-21_0-6-53.png) After the list of privileges has been selected, the user can choose the Permission Type: Deny or Allow, as shown below. [![Select permission](/aem/articles/touch-ui-principal-view/select-permission.png)](https://github.com/AdobeDocs/experience-manager-65.en/blob/d4bc00353812d963d2318cd148c6dbbac6bb2334/help/sites-administering/assets/screen_shot_2019-03-17at63938pm.png)### Using Restrictions In addition to the list of privileges and the Permission Type on a given path, this screen also lets you add restrictions for fine grained access control as shown below: [![Add restrictions](/aem/articles/touch-ui-principal-view/add-restrictions.png)](https://github.com/AdobeDocs/experience-manager-65.en/blob/d4bc00353812d963d2318cd148c6dbbac6bb2334/help/sites-administering/assets/image2019-3-21_1-4-14.png) > \[!note] Note > For more information on what each restriction means, see [the Jackrabbit Oak Documentation](https://jackrabbit.apache.org/oak/docs/security/authorization/restriction.html). Restrictions can be added as shown below by choosing the restriction type, entering the value and hitting the **+** icon. [![Add the restriction type](/aem/articles/touch-ui-principal-view/sapte-1.png)](https://github.com/AdobeDocs/experience-manager-65.en/blob/d4bc00353812d963d2318cd148c6dbbac6bb2334/help/sites-administering/assets/sapte-1.png)The new ACE is reflected in the Access Control List as shown below. Note that `jcr:write` is an aggregate privilege that includes `jcr:removeNode` that was added above, but is not shown below as its covered under `jcr:write`. ### Editing ACEs Access Control Entries can be edited by selecting a principal and choosing the ACE that you want to edit. For example, here you can edit the below entry for **dam-users** by clicking the pencil icon on the right: [![Add restriction](/aem/articles/touch-ui-principal-view/add-restriction.png)](https://github.com/AdobeDocs/experience-manager-65.en/blob/d4bc00353812d963d2318cd148c6dbbac6bb2334/help/sites-administering/assets/image2019-3-21_0-35-39.png) The edit screen is shown with configured ACEs preselected, these can be deleted by clicking the cross icon next to them or new privileges can be added for the given path, as shown below. [![Edit entry](/aem/articles/touch-ui-principal-view/noua-1.png)](https://github.com/AdobeDocs/experience-manager-65.en/blob/d4bc00353812d963d2318cd148c6dbbac6bb2334/help/sites-administering/assets/noua-1.png) Here the `addChildNodes` privilege is added for **dam-users** on the given path. [![Add privilege](/aem/articles/touch-ui-principal-view/add-privilege.png)](https://github.com/AdobeDocs/experience-manager-65.en/blob/d4bc00353812d963d2318cd148c6dbbac6bb2334/help/sites-administering/assets/image2019-3-21_0-45-35.png) Changes can be saved by clicking the **Save** button on top right, and the changes are reflected in the new permissions for **dam-users** as shown below: [![Save changes](/aem/articles/touch-ui-principal-view/zece-1.png)](https://github.com/AdobeDocs/experience-manager-65.en/blob/d4bc00353812d963d2318cd148c6dbbac6bb2334/help/sites-administering/assets/zece-1.png) ### Deleting ACEs Access Control Entries can be deleted to remove all permissions given to a principal on a specific path. The X icon on next to ACE can be used to delete it as shown below: [![Delete ACEs](/aem/articles/touch-ui-principal-view/delete-aces.png)](https://github.com/AdobeDocs/experience-manager-65.en/blob/d4bc00353812d963d2318cd148c6dbbac6bb2334/help/sites-administering/assets/image2019-3-21_0-53-19.png)### Classic UI Privilege Combinations The new permissions UI explicitly uses the basic set of privileges instead of predefined combinations that do not truly reflect the exact underlying privileges that were granted. It caused confusion as to what exactly is being configured. The following table lists the mapping between the privilege combinations from the Classic UI to the actual privileges that constitute them: | Classic UI Privilege Combinations | Permissions UI Privilege | | --------------------------------- | --------------------------------------------------------------------- | | Read | `jcr:read` | | Modify | `jcr:modifyProperties` `jcr:lockManagement` `jcr:versionManagement` | | Create | `jcr:addChildNodes` `jcr:nodeTypeManagement` | | Delete | `jcr:removeNode` `jcr:removeChildNodes` | | Read ACL | `jcr:readAccessControl` | | Edit ACL | `jcr:modifyAccessControl` | | Replicate | `crx:replicate` |