Has anyone out there used Content Porter and Template Builder in Single Sign On (SSO) Tridion environment? Do we have any documentation around using these tool with SSO?

2 Answers 2


Yes they do. That is: it is possible to let the client tools connect to the CM server through an SSO proxy. Prerequisite for such a configuration is that the SSO proxy uses HTTP basic auth for those endpoints One could argue that is hardly a SSO experience, but that is as far as it goes currently.

  • My next question then will be is there any documentation around this? Has anyone done this? Can anyone share how they got CP and and template builder working in their own SSO environment? Commented Jun 19, 2015 at 11:09
  • I haven't set this up but the docs cover SSO here. Commented Jun 22, 2015 at 2:51
  • I have set it up everything else works except Content Porter and Template builder even after excluding them as described in the documentation. The current work around is to have another CMS box that does not use SSO, but this defeats the aim of using SSO in the first place. Commented Jul 27, 2015 at 15:56
  • we have tried this as well and not gotten it to work. Commented Nov 25, 2015 at 16:10
  • It would also be helpful to mention that Content porter and template builder can be configured in mixed mode i.e; authentication to CM will be via SSO and clients are authenticated with Windows or Active directory. I believe this setup can work over HTTP and HTTPs as well (I have to try HTTPS).
    – Shiva
    Commented Nov 25, 2015 at 20:54

To set up Content Porter to work with SSO in mixed mode you need to:

1) In IIS find "SDL Tridion" Web site, for ImportExportService application and ImportExportService/Client folder in Authentication settings set AnonymousAuthentication to Enabled (other Authentications should be Disabled)

2) In IIS find "SDL Tridion" Web site, for Webservices application in Authentication settings set AnonymousAuthentication and WindowsAuthentication to Enabled (other Authentications should be Disabled)

3) Open Web.config under ..Tridion\webservices directory and

under <system.webServer><modules>... </modules></system.webServer> add <remove name="SsoAgentHttpModule" />

under <system.serviceModel><bindings><basicHttpBinding>...<basicHttpBinding><bindings><system.serviceModel> 
- For CoreService_basicHttpBinding, StreamDownload_basicHttpBinding and ImportExport_StreamDownload_basicHttpBinding set <transport clientCredentialType="Windows" /> 
- For StreamUpload_basicHttpBinding and ImportExport_StreamUpload_basicHttpBinding set <security mode="None"/>

under <wsHttpBinding></wsHttpBinding> make sure <security mode="Message" <message clientCredentialType="Windows" /> </security> exists

4) Save Web.config

5) In Tridion Configuration Manager console under General settings, ensure the "Urls without HTTP authentication" contains "CoreService|ImportExportService" and "ImportExportService/Client"

6) Restart IIS, Tridion Content Manager Service Host service for the changes to take effect. After the changes login to Content Manager from Content Porter, it is now set to mixed mode.

This steps can't be found in SDL official documentation which was a big problem when I was implementing SSO.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.