Surge Migrate

Not supported on Cloud Service

Replacing getAdministrativeResourceResolver with service users

getAdministrativeResourceResolver and loginAdministrative have been deprecated in Sling for years. On Cloud Service your bundles cannot use administrative sessions, so every call needs a service user with only the permissions it requires.

Affected packages and APIs

  • ResourceResolverFactory.getAdministrativeResourceResolver
  • SlingRepository.loginAdministrative

What to use instead

ResourceResolverFactory.getServiceResourceResolver with a sub-service name, a system user created through repoinit, and a ServiceUserMapperImpl.amended OSGi configuration.

How to fix it

  1. List each call site and the paths it reads or writes.
  2. Create a system user per purpose with a repoinit script (create service user, set ACL).
  3. Map bundle and sub-service to the user in org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended-<name>.cfg.json.
  4. Replace the call with getServiceResourceResolver and close the resolver in a try-with-resources block.

AEM 6.5

ResourceResolver rr = factory.getAdministrativeResourceResolver(null);

Cloud Service

Map<String, Object> auth = Map.of(ResourceResolverFactory.SUBSERVICE, "content-reader");
try (ResourceResolver rr = factory.getServiceResourceResolver(auth)) {
  // read only what the content-reader user is allowed to read
}

How we detect it

  • Readiness scan rule admin-resolver: Administrative resource resolver or session.

Best Practices Analyzer reports it under DG.

Can agents fix it?

High for the code change. A human approves each service user's permissions.

Source: Adobe Experience League. Checked 19 October 2026.