In this tutorial let us see the details on Sling Reverse Distribution on AEM.

• A reverse distribution setup allows one to transfer content from a farm of source instances(publisher) to a target instance(author). 
• That is done by pulling the content from source instances(publisher) into the target instance(author).

• configure a “reverse" agent on author(target instance) pointing to the URL of the exporter on publish, multiple publisher endpoints can be configured

• Configure Reverse Agent in Author
• Configure Queue agent  and exporter on Publisher
• Enable Triggers – Scheduled/JCREvent
• Test – CURL/Triggers

Configure Reverse Agent in Author

Save the configurations , the agent is created now but the status is paused 

Resume the agent by clicking on the resume button on the agent detail page.

The agent is now ready to Pull the distribution content from publisher.

Access http://localhost:4503/aem/start.html, Tools - Deployments - Distribution

Save the configurations, Queue Distribution Agent is enabled now

Let us now configure Exporter

Access http://localhost:4503/system/console/configMgr/org.apache.sling.distribution.packaging.impl.exporter.AgentDistributionPackageExporterFactory

Enter name - "reverse"

Let us now see how to automate the reverse distribution through triggers

Configure a JCR Event Trigger in Publisher to add the JCR changes under the configured path to the Distribution queue

Access http://localhost:4503/system/console/configMgr/org.apache.sling.distribution.trigger.impl.JcrEventDistributionTriggerFactory

Enter name - "reverse-sync"

Path for which the changes are distributed - "/content/we-retail"

Use deep distribution - Enable this if want to distribute the subtree of the configured node on any events

Configure a Scheduled Event Trigger in Author

The CRXDE/Package Manager was accessible by login through crx/explorer(http://localhost:4503/crx/explorer/index.jsp) or through system/console(http://localhost:4503/system/console) but not directly.

After analysis, identified the issue can happen in one of the below scenarios

The  problem should be addressed by enabling the read permission manually.

Prerequisite

• Google Cloud Account
• Externally accessible websites

Scenario

I have a website running in external server – test.albinsblog.com, I want to activate the CDN in front of my website.

Steps

• Register for a Google Cloud Account
• Create new HTTP(S) Load Balancer
• Enable CDN
• Enable A-Record for DNS

Register for a Google Cloud CDN

If you not enabled for Google Cloud CDN then access https://cloud.google.com/cdn and click on “Try Cloud CDN Free”
Configure the Payment Profile. This will take sometime to complete the configuration; you should be seeing “Compute Engine is getting Ready”, once after the Compute Engine is ready you will see the option to add CDN Origin.

Create new HTTP(S) Load Balancer

As a first step, let us configure the new HTTP(S) Load Balancer. Click Add origin on the previous screen and Click on Continue on the Next screen. Select “Use a custom origin” and click on “Create a load balancer.
Enter a unique name for the load balancer. Click on back end configuration and create a backend service

Enter a name and select backend Type as “Internet Network endpoint group”, change the protocol as required – this protocol will be used by Google Load balancer to connect to the origin server. I am going with HTTP protocol for the demo

Select “Create Internet network endpoint group” from "Internet network endpoint group" dropdown

Enter a name

Select the protocol users uses to connect to the website, the SSL certificate should be uploaded if the protocol is selected as HTTPS with supported Domains.
You can upload the existing certificate or create google managed SSL certificate

I am going with HTTP for the demo
Create new IP address – the default IP address lives for short time, create a static IP address.
Now the HTTP(S) Load Configuration is ready and enabled with CDN

Enable A-Record for DNS

Now your website is accessible through the Google CDN Front end IP, add a A-Record pointing to the Frond End Ip for the website DNS through your network provider – my case cloudflare

e.g test.albinsblog.com A-Record 34.120.141.59

Now test.albinsblog.com should be accessible through Google CDN, you can monitor the traffics through console and also the cache path can be invalidated whenever required.


My backend server is running on Apache, I have enabled the Virtual host configuration to support test.albinsblog.com - Google CDN sends the DNS values as part of Host header, enable different virtual host to support multiple websites.

<VirtualHost *:80>
    ServerAdmin [email protected]
    DocumentRoot "C:\opt\communique\dispatcher\cache"
    ServerName test.albinsblog.com
    ServerAlias localhost

    RewriteEngine On

   RewriteRule ^/test.html$ http://test.albinsblog.com/content/wknd/fr/fr.html [L]

   <Directory />

Options Indexes FollowSymLinks Includes   
# Set includes to process .html files
AddOutputFilter INCLUDES .html
AddOutputFilterByType INCLUDES text/html
AllowOverride None
    </Directory>
</VirtualHost>

Conclusion

This concludes CDN is enabled on the custom origin website. The same setup can be used to support multiple websites, the backend(origin) should support the required DNS – Google CDN sends the Host header with the DNS value the user is accessing from the browser. The host header in the origin server can be used to enable the DNS specific functionalities. The Google CDN improves the website performance by caching and serving the website content from network of servers across the world, the server will be contacted in case the requested content is not available in the CDN cache.

Social login is the ability to present the option for a site visitor to sign in with their social accounts like Facebook, Twitter, LinkedIn and etc. AEM supports OOTB Facebook and Twitter Social logins but LinkedIn login is not supported OOTB and need to build custom Provider to support the log in flow for websites. 

AEM internally uses the scribejava module to support the Social login flows, scribejava supports multiple providers and both OAuth 1.0 and OAuth 2.0 protocols. The scribe version shipped with AEM won’t support the LinkedIn OAuth 2.0 authentication flow but OAuth 1.0 is supported.

This tutorial explains the steps and the customization required to support the LinkedIn social login in AEM as Cloud version, the same should work with minimal change for other AEM versions.

Prerequisites

AEM Login URL 

LinkedIn Authorization Page URL

Access Token URL(GET)

Retrieve Profile Data

• LinkedIn App Setup
• Setup Custom LinkedIn OAuth Provider
• Configure Service User
• Configure OAuth Application and Provider
• Enable OAuth Authentication
• Test the Login Flow
• Encapsulated Token Support
• Sling Distribution user’s synchronization

As a first step, we should setup the OAuth app from LinkedIn. Login to https://www.linkedin.com/developers/ and click on Create App

Now enable the service user mapping for provider bundle – add an entry into Apache Sling Service User Mapper Service Amendment linkedin.oauth.provider:oauth-linkedin-service=oauth-linkedin-service

Setup Custom LinkedIn OAuth Provider

Configure OAuth Application and Provider

Let us now enable the “Adobe Granite OAuth Application and Provider” for LinkedIn

Config ID – Enter a unique value, this value should be used while invoking the AEM login URL
Client ID – Copy the Client ID value from LinkedIn App
Client Secret - Copy the Client Secret value from LinkedIn App(Copy the secret by reveling the value)
Scope - r_liteprofile r_emailaddress
Provider ID – linkedin
Create users – Select the check box to create AEM users for LinkedIn profiles
Callback URL – the same value configured in LinkedIn App(http://localhost:4503/callback/j_security_check)

Enable OAuth Authentication

Now the configurations are ready, let us initiate the login – access http://localhost:4503/j_security_check?configid=linkedin from browser(in real scenario you can enable a link or button pointing to this URL). This will take the user to LinkedIn login screen

Whenever the profile data is changed (e.g firstName and LastName) in LinkedIn the same will be reflected to AEM in subsequent login based on the “Apache Jackrabbit Oak Default Sync Handler” configuration.

AEM creates “Apache Jackrabbit Oak Default Sync Handler” configuration specific to each OAuth provider implementations.

The sync handler syncs the user profile data between the external authentication system and AEM repository.

The user profile data is synced based on the User Expiration Time setting, the user data will get synced on the subsequent login after the synced user data expired(default is 1 hr). Modify the configurations based on the requirement.

Encapsulated Token Support

Enable the Encapsulated Token Support in "Adobe Granite Token Authentication Handler"

Sling Distribution user’s synchronization

The users created in a publisher should be synced to all the other publishers in the farm to support the seamless authentication. I am not finding good reference document to explain the user sync in AEM as Cloud(AEM Communities features are not enabled in AEM as Cloud Service, the user sync was enabled through the community components for other AEM version), planning to cover the user sync in another tutorial.

This tutorial is mainly focused on enabling the authenticate the website users through LinkedIn profile but the same solution can be used with small changes to support different providers. The user authentication is enabled through OAuth 2.0 protocol as LinkedIn was already deprecated the OAuth 1.0. Custom providers and helper classes are required to support the authentication flow as AEM OOTB don’t support the authentication with LinkedIn but supports twitter and Facebook. Feel free to give your feed back and changes on the provider bundle.