Inherited groups and how to validate them using the REST API

[JimLittle]

I want to write postman tests to enumerate (and verify) the user groups assigned in the User Permissions of QEM, Replicate and Compose using the GetServerAcl API.  I am aware that if the servers (Replicate and Compose) managed by QEM inherit their ACLs, the GetServerAcl will return AEM_SERVER_HAS_NO_ACL.

Since I have QEM, should I be defining my user groups for each application through QEM | Servers | ServerManagement | Permissions?

If I have QEM and I assign user groups IN REPLICATE AND COMPOSE (instead of through QEM) in each User Permissions area, how are those groups different IN REPLICATE AND COMPOSE than groups that I could have defined in QEM (in the first question)? 

If user groups are defined at both QEM and REPLICATE AND COMPOSE, what is the effective permissions?  Is there a precedence?

Is it even possible to get a list of the user groups if they are assigned IN REPLICATE AND COMPOSE from the GetServerAcl API?  Or is GetServerAcl only EVER able to return user groups assigned from QEM?

If the Acls for REPLICATE AND COMPOSE are created and inherited from QEM, the GetServerAcl will return 500.  Is there any way to get a list of Acls assigned at the QEM level that ARE inherited by REPLICATE AND COMPOSE?

Thanks, 

Jim

[OritA]

Hi Jim, 

Please open a case with all the details mentioned above so we can check all the mentioned scenarios and provide you the answers you are looking for. 

Thanks, 

Orit

[vaskyb3]

if a user adds another space, then you can send a post request to api/spaces/:spaceId?userId="123" then after adding the user to the space, you can also hit the Users model (assuming you're using MongoDB) or whatever and update the user { spaces: [reference/to/space, reference/to/space] }