It is useful to point out that I've started out with a completely working SDL Tridion installation (HTTPS) after which I've decided to implement LDAP (directory service) authentication for Tridion.
I've followed all steps in the documentation on [SDL LiveContent][1] for enabling LDAP authentication but i'm getting 500 errors back from the server when the WebGUI connects to it's own service layer (TCM54/CME).
The error details in the event log are not too helpful:
Unable to Initialize TDSE object.
Access is denied for the user NT AUTHORITY\NETWORK SERVICE.
Error Code: 0x80040302 (-2147220734) Call stack:
Tridion.ContentManager.Security.AuthorizationManager.LoadAccessToken(String,IEnumerable
1,IEnumerable1) Tridion.ContentManager.Security.AuthorizationManager.LoadAccessToken(String,String) Tridion.ContentManager.Session..ctor(String,String,UserContext) Tridion.ContentManager.BLFacade.SystemFacade.InitializeUserContext(UserContext,String,String) UtilitiesTDS.GetUserContext TDSE.Initialize
It does indicate (strongly) that there is a problem with the LDAP identity not being picked up (hence it uses the process context which is NT AUTHORITY\NETWORK SERVICE).
Looking at the IIS logs we see the following:
2013-05-08 14:31:21 172.16.188.4 POST /WebUI/Models/TCM54/Services/General.svc/GetUserSettings - 443 HINTTECH:bdommelen 95.128.91.188 Mozilla/5.0+(Windows+NT+6.0;+WOW64;+rv:20.0)+Gecko/20100101+Firefox/20.0 500 0 0 374
and also
2013-05-08 14:31:18 127.0.0.1 POST /WebUI/Models/CME/Services/General.svc/GetListCustomPages - 80 HINTTECH:bdommelen 127.0.0.1 - 500 0 0 124
The WebGUI site itself has no problems with the new authentication settings (I can also verify that the LDAP authentication itself is working as I get the login prompt and entering non-valid credentials gives me the 401 error). Another sample from the IIS logs:
2013-05-08 14:30:55 172.16.188.4 GET /WebUI/Editors/CME/Themes/Carbon/Images/Icons/mc.error.16x16.png - 443 - 95.128.91.188 Mozilla/5.0+(Windows+NT+6.0;+WOW64;+rv:20.0)+Gecko/20100101+Firefox/20.0 401 0 0 249
2013-05-08 14:30:56 172.16.188.4 GET /WebUI/Editors/CME/Themes/Carbon/Images/Icons/mc.error.16x16.png - 443 HINTTECH:bdommelen 95.128.91.188 Mozilla/5.0+(Windows+NT+6.0;+WOW64;+rv:20.0)+Gecko/20100101+Firefox/20.0 200 0 0 46
The above shows the normal 401/200 responses for one of the icons of the WebGUI.
I had gone over every inch of the web.config configurations in WebUI, WebRoot and TCM54 until I decided to have a look at the error message details in Firebug which has lots of the following in it:
"StackTrace":" at Tridion.ContentManager.Interop.TDS.TDSEClass.get_User()\u000d\u000a at Tridion.Web.UI.Models.TCM54.WCFServiceBase.LocalizedException(Exception ex)\u000d\u000a at Tridion.Web.UI.Models.TCM54.R5WSImpl.GetUserSettings()\u000d\u000a at Tridion.Web.UI.Models.TCM54.General.GetUserSettings()\u000d\u000a at SyncInvokeGetUserSettings(Object , Object[] , Object[] )\u000d\u000a at System.ServiceModel.Dispatcher.SyncMethodInvoker.Invoke(Object instance, Object[] inputs, Object[]& outputs)\u000d\u000a at System.ServiceModel.Dispatcher.DispatchOperationRuntime.InvokeBegin(MessageRpc& rpc)\u000d\u000a at System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage5(MessageRpc& rpc)\u000d\u000a at System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage41(MessageRpc& rpc)\u000d\u000a at System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage4(MessageRpc& rpc)\u000d\u000a
indicating that the problem is on the server side in some WCF call. So I looked at TcmServiceHost.exe.config (strangely enough not mentioned in either the 2011SP1 or 2013 LiveContent docs) and found that there are two places that refer to LDAP authentication:
<!-- For LDAP authentication of message credentials, use the following settings: -->
<security mode="Message">
<message clientCredentialType="UserName" />
</security>
<!-- The LdapAuthorizationPolicy policy is required for LDAP authentication -->
<!-- <serviceAuthorization>
<authorizationPolicies>
<add policyType="Tridion.Security.IdentityModel.LdapAuthorizationPolicy, Tridion.Security, Version=6.1.0.25, Culture=neutral, PublicKeyToken=ddfc895746e5ee6b" />
</authorizationPolicies>
</serviceAuthorization> -->
I had naturally uncommented both sections but unfortunately the second one poses a problem:
Could not load type 'Tridion.Security.IdentityModel.LdapAuthorizationPolicy' from assembly 'Tridion.Security, Version=6.1.0.25, Culture=neutral, PublicKeyToken=ddfc895746e5ee6b'.
Apparently there is no LdapAuthorizationPolicy in Tridion.Security (I've verified this in Reflector). I've tried the only class that implements IAuthorizationPolicy (ClaimsPrincipalAuthorizationPolicy) but that didn't help so I've ended up commenting out the part again (which removes the event log error above but does not solve my 500 error).
All of the journey above leaves me with three questions:
1. Is the LdapAuthorizationPolicy class needed for the CoreService and how where do I find it if so?
2. Is my conclusion that the CoreService is not properly picking up the authentication context from the request correct or is the problem somewhere else?
3. Has anyone completed a similar setup succesfully and what were the steps that needed to be taken on top of the available documentation?
