A user is part of the Employees LDAP group synchronized with AEM. The same user is added to the authors group in AEM. The user is then removed from the Employees group on the LDAP server. What is…

Question

Options

• AThe user is removed from both the Employees and the AEM authors groups
• BThe user is removed from the authors group but not the Employees group in AEM
• CThe user is removed from the Employees group but not the authors group in AEM
• DThe user is not removed from either the Employees and the AEM authors groups

• A
  77% (43)
• B
  9% (5)
• C
  11% (6)
• D
  4% (2)

Explanation

Option A is correct because AEM's LDAP synchronization handler treats the external identity provider (LDAP) as the authoritative source for user existence. When a user is removed from the synchronized LDAP group (Employees), the next sync triggers removal of the user's AEM account or clears all associated group memberships - including any groups manually assigned within AEM (like authors) - because the user's identity is no longer validated by the external source.

Why the distractors are wrong:

• B reverses the logic: the authors group (local) would be removed, not preserved, once LDAP no longer validates the user.
• C is the intuitive but incorrect answer - it assumes AEM-local group memberships are independent and persistent, but the LDAP sync reconciles the entire user identity, not just the mirrored LDAP groups.
• D is wrong because LDAP synchronization is designed to enforce consistency; ignoring removals would defeat its purpose.

Memory tip: Think of LDAP sync as an identity passport. If LDAP revokes your passport (removes you from the synced group), AEM won't let you stay in any room - not even rooms (groups) you were given keys to locally. "No passport, no access - anywhere."

No community discussion yet for this question.