7

I am using SDL Tridion 2013 SP1, and attempting to run the CD Webservice on Windows 2012 Server as a .NET Application. I have successfully installed the CD Web Service, and have successfully queried it for data, and everything is working fine. So far so good.

I am now in the process of securing the service. I have enabled HTTPS, and everything still works fine. My next step was to secure the service by requiring authorization. So I modified the cd_webservice_conf.xml file. It now looks like this:

<Configuration Version="7.1" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="schemas/cd_webservice_conf.xsd">
    <OData>
        <DefaultTop>25</DefaultTop>
        <FixedPublicationId>1</FixedPublicationId>
    </OData>
    <AuthenticationServer ForceSecure="true">
        <TokenExpireTime TimeInSeconds="3600"/>
        <SharedSecret>MySecret</SharedSecret>
    </AuthenticationServer>
    <Accounts>
        <Account Id="MyUserName" Password="MyPAssword"/>
    </Accounts>
</Configuration>

I can still access the OData.svc and get data just fine, and I am able to get an access token from the access_token.svc. In order to secure the service I have un-commented the security nodes in the cd_ambient_conf.xml and set the SharedSecret to match the SharedSecret in the cd_webservice_conf.xml

This manages to secure the OData Service, and if I query it using the token I received in the previous step, I am able to get data.

However when I try to get a new AccessToken, I receive a 401 error. It seems that the access_token.svc is also secured. How do I apply security to the odata.svc, but continue to allow access to the access_token.svc?

7

It seems like I missed this step in the manual:

<ExcludedPaths>
    <Path>/access_token.svc/</Path>
</ExcludedPaths>

In the ADF config file

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.