I am using SDL Tridion 2013 SP1, and attempting to run the CD Webservice on Windows 2012 Server as a .NET Application. I have successfully installed the CD Web Service, and have successfully queried it for data, and everything is working fine. So far so good.
I am now in the process of securing the service. I have enabled HTTPS, and everything still works fine. My next step was to secure the service by requiring authorization. So I modified the cd_webservice_conf.xml file. It now looks like this:
<Configuration Version="7.1" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="schemas/cd_webservice_conf.xsd"> <OData> <DefaultTop>25</DefaultTop> <FixedPublicationId>1</FixedPublicationId> </OData> <AuthenticationServer ForceSecure="true"> <TokenExpireTime TimeInSeconds="3600"/> <SharedSecret>MySecret</SharedSecret> </AuthenticationServer> <Accounts> <Account Id="MyUserName" Password="MyPAssword"/> </Accounts> </Configuration>
I can still access the OData.svc and get data just fine, and I am able to get an access token from the access_token.svc. In order to secure the service I have un-commented the security nodes in the cd_ambient_conf.xml and set the SharedSecret to match the SharedSecret in the cd_webservice_conf.xml
This manages to secure the OData Service, and if I query it using the token I received in the previous step, I am able to get data.
However when I try to get a new AccessToken, I receive a 401 error. It seems that the access_token.svc is also secured. How do I apply security to the odata.svc, but continue to allow access to the access_token.svc?