CoreService and TemplateBuilder access in SSO setup with ADFS

Question

In SDL Web 8.5, I implemented a simple-ish HTTPModule that bridges the CME with ADFS 2016 (using SAML) and provides the SSO UserId request header to the CME web applications. This works fine.

I'm now attempting to connect to CoreService (or TemplateBuilder), but so far with little success. I read several posts about running CoreService behind an SSO proxy that exposes a basic auth endpoint. I see such proxy in the CME, but I can't any information about it.

Also I see people had success running the services in mixed authentication mode (using traditional Windows or Integrated security). That is not an option to me, since the Active Directory is not available to the CME server.

What options do I have? Has anybody implemented some kind of token mechanism in front of CM services to relay the UserId SAML claim from ADFS to CoreService for example? Is this path viable? Any other ideas/concerns?

Answer 1

We did use OpenAm SSO setup for Content Manager authentication.

Excluded the core services and templates from OpenAM SSO authentication and enabled LDAP authentication it works.

In [Tridion-Home]\webservices\Web.config

 <system.webServer>
    <modules>
      <remove name="SsoAgentHttpModule" />
      <remove name="OpenAmModule64" />
      <!-- This must be enabled for transport-level LDAP authentication and disabled in other cases -->
      <add name="LdapAuthenticationHttpModule" type="Tridion.Security.Web.LdapAuthenticationHttpModule, Tridion.Security, Version=8.5.0.60, Culture=neutral, PublicKeyToken=ddfc895746e5ee6b" />
      <!-- -->
      <!-- This must be enabled for transport-level SSO authentication and disabled in other cases -->
      <!--
      <add name="SsoAgentHttpModule" type="Tridion.Security.Web.SsoAgentHttpModule, Tridion.Security, Version=8.5.0.60, Culture=neutral, PublicKeyToken=ddfc895746e5ee6b" />
      -->
    </modules>
    <handlers>
      <!-- We want to make sure that the .NET 4.0 version of the Svc-Integrated handler is handling our request for WCF service extensions. The old handler could be first in the ordered list, therefore remove it -->
      <remove name="svc-Integrated" />
    </handlers>
    <validation validateIntegratedModeConfiguration="false" />
  </system.webServer>

Setting up Content Manager for LDAP

Edit Updated1:

Did you configure anything else?

No, but worth double check the https configuration [Tridion-Home]\SDL Web\bin\Configuration Scripts\SetupHTTPS.ps1 - I'm not sure it's applicable to your setup.

Where is the authentication coming in LDAP?

The system connected with AD domain but you can configure Directory Services in Tridion Console.

Did you set up that up in the Tridion Management snap-in?

Only for Single Sing On for Username Header value.

I hope it helps.