How to secure the CD Web Service and allow access to the token service?

Question

I am using SDL Tridion 2013 SP1, and attempting to run the CD Webservice on Windows 2012 Server as a .NET Application. I have successfully installed the CD Web Service, and have successfully queried it for data, and everything is working fine. So far so good.

I am now in the process of securing the service. I have enabled HTTPS, and everything still works fine. My next step was to secure the service by requiring authorization. So I modified the cd_webservice_conf.xml file. It now looks like this:

<Configuration Version="7.1" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="schemas/cd_webservice_conf.xsd">
    <OData>
        <DefaultTop>25</DefaultTop>
        <FixedPublicationId>1</FixedPublicationId>
    </OData>
    <AuthenticationServer ForceSecure="true">
        <TokenExpireTime TimeInSeconds="3600"/>
        <SharedSecret>MySecret</SharedSecret>
    </AuthenticationServer>
    <Accounts>
        <Account Id="MyUserName" Password="MyPAssword"/>
    </Accounts>
</Configuration>

I can still access the OData.svc and get data just fine, and I am able to get an access token from the access_token.svc. In order to secure the service I have un-commented the security nodes in the cd_ambient_conf.xml and set the SharedSecret to match the SharedSecret in the cd_webservice_conf.xml

This manages to secure the OData Service, and if I query it using the token I received in the previous step, I am able to get data.

However when I try to get a new AccessToken, I receive a 401 error. It seems that the access_token.svc is also secured. How do I apply security to the odata.svc, but continue to allow access to the access_token.svc?

Answer 1

It seems like I missed this step in the manual:

<ExcludedPaths>
    <Path>/access_token.svc/</Path>
</ExcludedPaths>

In the ADF config file