Sling Authentication Servlet — Secret powers for access

The sling authentication service (org.apache.sling.engine.impl.auth.SlingAuthenticator) controls a bunch of different functions but the most critical is that it determines what an anonymous user can access.

Why do you care?
A number of the different default behaviors between author and publish mode servers come from changes to the default configuration to this service. In Author mode, anonymous access is disabled except for the login screen and a few other paths (like crxde light). In publish mode, anonymous access is ENABLED allowing an anonymous user to access just about anything.

When securing AEM, you may wish to change this behavior. Either by opening up certain parts of the author (say to other backend services behind a firewall) or closing off parts of the publisher (requiring authentication to access certain reports).