Has anyone out there used Content Porter and Template Builder in Single Sign On (SSO) Tridion environment? Do we have any documentation around using these tool with SSO?
Add a comment
|
2 Answers
Yes they do. That is: it is possible to let the client tools connect to the CM server through an SSO proxy. Prerequisite for such a configuration is that the SSO proxy uses HTTP basic auth for those endpoints One could argue that is hardly a SSO experience, but that is as far as it goes currently.
answered Jun 18, 2015 at 13:28
-
My next question then will be is there any documentation around this? Has anyone done this? Can anyone share how they got CP and and template builder working in their own SSO environment? Commented Jun 19, 2015 at 11:09
-
-
I have set it up everything else works except Content Porter and Template builder even after excluding them as described in the documentation. The current work around is to have another CMS box that does not use SSO, but this defeats the aim of using SSO in the first place. Commented Jul 27, 2015 at 15:56
-
we have tried this as well and not gotten it to work. Commented Nov 25, 2015 at 16:10
-
It would also be helpful to mention that Content porter and template builder can be configured in mixed mode i.e; authentication to CM will be via SSO and clients are authenticated with Windows or Active directory. I believe this setup can work over HTTP and HTTPs as well (I have to try HTTPS).– ShivaCommented Nov 25, 2015 at 20:54
To set up Content Porter to work with SSO in mixed mode you need to:
1) In IIS find "SDL Tridion" Web site, for ImportExportService application and ImportExportService/Client folder in Authentication settings set AnonymousAuthentication to Enabled (other Authentications should be Disabled)
2) In IIS find "SDL Tridion" Web site, for Webservices application in Authentication settings set AnonymousAuthentication and WindowsAuthentication to Enabled (other Authentications should be Disabled)
3) Open Web.config under ..Tridion\webservices directory and
under <system.webServer><modules>... </modules></system.webServer> add <remove name="SsoAgentHttpModule" />
under <system.serviceModel><bindings><basicHttpBinding>...<basicHttpBinding><bindings><system.serviceModel>
- For CoreService_basicHttpBinding, StreamDownload_basicHttpBinding and ImportExport_StreamDownload_basicHttpBinding set <transport clientCredentialType="Windows" />
- For StreamUpload_basicHttpBinding and ImportExport_StreamUpload_basicHttpBinding set <security mode="None"/>
under <wsHttpBinding></wsHttpBinding> make sure <security mode="Message" <message clientCredentialType="Windows" /> </security> exists
4) Save Web.config
5) In Tridion Configuration Manager console under General settings, ensure the "Urls without HTTP authentication" contains "CoreService|ImportExportService" and "ImportExportService/Client"
6) Restart IIS, Tridion Content Manager Service Host service for the changes to take effect. After the changes login to Content Manager from Content Porter, it is now set to mixed mode.
This steps can't be found in SDL official documentation which was a big problem when I was implementing SSO.