A customer has a requirement to allow authors to access AEM with single sign-on. To achieve this an Architect needs to integrate AEM with the customer's identity management system. Which two actions…

The correct answer is A. Implement the generic SSO Authentication Handler interface D. Configure the generic SSO Authentication Handler. Options A and D are correct because AEM's Generic SSO Authentication Handler is the purpose-built mechanism for integrating AEM with an external identity management system, and there are two valid ways to use it: configuring the existing out-of-the-box handler via OSGi…

Design and Architecture

Question

A customer has a requirement to allow authors to access AEM with single sign-on. To achieve this an Architect needs to integrate AEM with the customer's identity management system. Which two actions could an Architect take to meet this requirement? (Choose two.)

Options

AImplement the generic SSO Authentication Handler interface
BConfigure the Sling Authentication Requirements for the OSGi HTTP Service
CConfigure the SAML Authentication Handler
DConfigure the generic SSO Authentication Handler
EImplement a custom JAAS Login Module

How the community answered

(39 responses)

A
82% (32)
B
3% (1)
C
5% (2)
E
10% (4)

Explanation

Options A and D are correct because AEM's Generic SSO Authentication Handler is the purpose-built mechanism for integrating AEM with an external identity management system, and there are two valid ways to use it: configuring the existing out-of-the-box handler via OSGi properties (Option D) for standard SSO token/header-based setups, or implementing the Generic SSO Authentication Handler interface (Option A) when custom logic is needed to process identity tokens from the customer's specific IMS.

Why the distractors are wrong:

B (Sling Authentication Requirements for OSGi HTTP Service) controls which paths require authentication, not how users are authenticated against an external IMS - it's a prerequisite config, not an SSO solution.
C (SAML Authentication Handler) is a valid SSO protocol, but it's a distinct, protocol-specific handler - the question asks about the generic SSO approach, making C a tempting but incorrect choice.
E (Custom JAAS Login Module) operates at the Java security layer below AEM's authentication framework; while technically capable, it's not the recommended AEM-native approach for SSO and bypasses the Sling authentication pipeline.

Memory tip: Think of the Generic SSO Handler as having two modes - "D for Deploy" (configure it) and "A for Adapt" (implement the interface) - both target the same handler, covering the configure-vs-extend split that AEM uses throughout its OSGi architecture.

Topics

#SSO Integration#AEM Authentication Handlers#JAAS Security#Identity Management

Community Discussion

No community discussion yet for this question.

Full AD0-E117 Practice