How to Connect Adobe AEM Assets (On-Prem, AMS, or AEMaaCS)

Adobe Experience Manager Assets ships in three different deployment forms. The HTTP API surface is the same across all three, but the authentication flow is different for each — and that's the only thing you really configure here.

When you add the AEM connector in Univaultport, the wizard asks you which deployment you're connecting to. Pick the matching section below for setup.

Track A — On-Premise AEM (6.x)

Step 1 — Identify the author URL

This is your AEM author tier URL — the same one your content team uses to log into AEM. Strip any trailing path:

✓ https://author.mysite.com
✓ https://author.mysite.com:4502
✗ https://author.mysite.com/aem/start.html  (strip the path)

Step 2 — Create or pick a service user

Personal accounts work but break the moment the human owner rotates passwords or leaves. The recommended pattern is a service user:

1. 1

   Log into AEM as administrator

   Open /useradmin in the author instance.
2. 2

   Create a user

   Click Create User. Use a descriptive ID like asset-migrator-svc.
3. 3

   Set a strong password

   This is what Univaultport will use for Basic auth. Store it somewhere safe — you can rotate it later via the wizard's edit drawer.
4. 4

   Grant permissions

   Under Members, add the user to the dam-users group. For migrations that need to delete or modify metadata, add it to content-authors too.
5. 5

   Test the permission

   Open /content/dam and confirm the new user can see it (/dam will 403 if permissions are wrong).

Step 3 — Paste credentials into Univaultport

In the connector wizard:

1. 1

   Deployment

   On-Premise (self-hosted AEM 6.x)
2. 2

   AEM Base URL

   https://author.mysite.com
3. 3

   Username

   asset-migrator-svc (from Step 2)
4. 4

   Password

   The service user's password
5. 5

   DAM Root Path (optional)

   /content/dam/marketing to scope; blank for the whole DAM

Click Save & test. Univaultport will fetch /api/assets/.json to validate.

Track B — AMS (Adobe Managed Services)

From the connector's point of view, AMS is almost identical to On-Prem — same HTTP API, same Basic auth header. Adobe just handles the infrastructure.

Step 1 — Find the author URL

AMS author URLs follow this pattern:

https://author-pXXXXX-eYYYYY.adobeaemcloud.com
                ↑ program ID    ↑ environment ID

You can find the exact URL in Adobe Cloud Manager → your AMS program → environment → Author tile.

Step 2 — Create a service user

AMS doesn't restrict you from creating local AEM users — the user-admin works the same as on-prem.

1. Log in to your AMS author instance with an admin account.
2. Open /useradmin and create a service user (same pattern as On-Prem).
3. Grant the same dam-users (or content-authors) membership.

Step 3 — Paste credentials into Univaultport

1. 1

   Deployment

   AMS — Adobe Managed Services
2. 2

   AEM Base URL

   The full https://author-pXX-eYY.adobeaemcloud.com URL
3. 3

   Username

   The service user ID
4. 4

   Password

   The service user password
5. 5

   DAM Root Path (optional)

   As On-Prem

Track C — AEM as a Cloud Service (AEMaaCS)

AEMaaCS is significantly more involved. It uses Adobe IMS (Identity Management Service) for auth. There are no usernames + passwords — instead, you create a Service Account in the Adobe IO Developer Console, download a Service Credentials JSON, and Univaultport uses that to mint short-lived bearer tokens.

Step 1 — Find your IMS Org ID + environment URL

In Adobe Admin Console (https://adminconsole.adobe.com):

• The IMS Org ID is shown under your Profile → Account Info — looks like XXXXXXXXXXXXXXXXXXXXXXXX@AdobeOrg.

For the AEMaaCS author URL, open Cloud Manager for your program, pick the production environment, and copy the author tier URL. It looks like:

https://author-pXXXXX-eYYYYY.adobeaemcloud.com

Step 2 — Create a project in Adobe IO Developer Console

Go to developer.adobe.com/console and sign in with the same Adobe account.

1. 1

   Create new project

   Click Create new project. Name it something like asset-migrator-aem.
2. 2

   Add an API

   Click Add API → AEM Assets Author (or AEM Assets, depending on your subscription).
3. 3

   Choose authentication

   Pick Service Account (JWT). This is the legacy but still-supported flow.
4. 4

   Generate key pair

   The console can generate the RSA keypair for you. Click Generate a key pair — your browser will download a ZIP with private.key and certificate_pub.crt. Save the private key safely — Adobe doesn't keep a copy.
5. 5

   Select product profile

   Choose the AEM environment's product profile. For most setups, AEM Administrators is the right one.
6. 6

   Save configured API

   Click Save configured API.

Step 3 — Download the Service Credentials JSON

Inside your IO project, click Service Account (JWT) in the left sidebar. Look for the Generate Service Credentials button on the right side of the page. Click it.

Adobe downloads a JSON file with this rough shape:

{
  "integration": {
    "imsOrgId": "...@AdobeOrg",
    "technicalAccount": {
      "id": "...",
      "email": "..."
    },
    "metascopes": ["ent_aem_cloud_api"],
    "imsEndpoint": "ims-na1.adobelogin.com"
  },
  "clientCredentials": {
    "client_id": "...",
    "client_secret": "..."
  },
  "privateKey": "-----BEGIN RSA PRIVATE KEY-----\n..."
}

Step 4 — Assign the technical account in AEMaaCS

The Service Account's "technical account" needs explicit AEM permissions. Just creating the API isn't enough.

1. 1

   Open Adobe Admin Console

   adminconsole.adobe.com
2. 2

   Find the technical account

   Users → Browse Users. Search for the technical-account email from your Service Credentials JSON (looks like xxxxxxxx-aem-tech@techacct.adobe.com).
3. 3

   Assign product profile

   Click into the user → Products and user groups → Adobe Experience Manager as a Cloud Service → assign the AEM Administrators profile for your target environment. Or the AEM Users profile if you want least-privilege.

Step 5 — Paste into Univaultport

1. 1

   Deployment

   AEM as a Cloud Service (AEMaaCS)
2. 2

   AEM Base URL

   The author URL from Step 1 (https://author-pXX-eYY.adobeaemcloud.com)
3. 3

   Service Credentials JSON

   Paste the entire JSON file contents from Step 3
4. 4

   DAM Root Path (optional)

   /content/dam/your-folder to scope

Click Save & test. Univaultport will:

1. Parse the Service Credentials JSON
2. Sign a JWT and exchange it at https://ims-na1.adobelogin.com/ims/exchange/jwt/
3. Use the returned bearer token to GET your DAM root

A green check means all three steps passed.

How uploads work (all three tracks)

Univaultport uses Adobe's Direct Binary Upload protocol for every flavor — it's the only path that AEMaaCS supports, and AEM 6.5+ on-prem supports it too. The protocol is:

1. POST /content/dam/parent.initiateUpload.json → AEM returns one-or-more pre-signed S3 URLs
2. PUT each chunk directly to S3 (bypasses AEM's JVM)
3. POST /content/dam/parent.completeUpload.json → AEM processes the asset

The upload is handled by Adobe's official @adobe/aem-upload library inside Univaultport, so retries, multipart, and progress callbacks are all built in.

Practical impact: there's no hard upload-size cap from AEM itself. Big videos (1+ GB) work as long as your network can sustain them.

Permissions cheatsheet

For each flavor, the principal needs the following on the DAM root path:

For most setups, adding the user to dam-users + content-authors (on-prem/AMS) or assigning the AEM Administrators product profile (AEMaaCS) gives you all three.

Troubleshooting

Next steps

With AEM connected, common migration patterns:

• AEM → S3 / GCS / Cloudinary: archive a legacy on-prem DAM to cheaper storage, or move to a delivery-optimized CDN
• AEM → AEM: cross-environment migrations (e.g. staging → prod, or AMS → AEMaaCS upgrade path)
• Cloudinary / Drive → AEM: bring an existing asset library into AEM for editorial workflows

Folder hierarchy is preserved on both source and destination since AEM has real folder nodes (sling:OrderedFolder JCR nodes) under /content/dam.