5

It is useful to point out that I've started out with a completely working SDL Tridion installation (HTTPS) after which I've decided to implement LDAP (directory service) authentication for Tridion.

I've followed all steps in the documentation on [SDL LiveContent][1] for enabling LDAP authentication but i'm getting 500 errors back from the server when the WebGUI connects to it's own service layer (TCM54/CME).

The error details in the event log are not too helpful:

Unable to Initialize TDSE object.

Access is denied for the user NT AUTHORITY\NETWORK SERVICE.

Error Code: 0x80040302 (-2147220734) Call stack:

Tridion.ContentManager.Security.AuthorizationManager.LoadAccessToken(String,IEnumerable1,IEnumerable1) Tridion.ContentManager.Security.AuthorizationManager.LoadAccessToken(String,String) Tridion.ContentManager.Session..ctor(String,String,UserContext) Tridion.ContentManager.BLFacade.SystemFacade.InitializeUserContext(UserContext,String,String) UtilitiesTDS.GetUserContext TDSE.Initialize

It does indicate (strongly) that there is a problem with the LDAP identity not being picked up (hence it uses the process context which is NT AUTHORITY\NETWORK SERVICE).

Looking at the IIS logs we see the following:

2013-05-08 14:31:21 172.16.188.4 POST /WebUI/Models/TCM54/Services/General.svc/GetUserSettings - 443 HINTTECH:bdommelen 95.128.91.188 Mozilla/5.0+(Windows+NT+6.0;+WOW64;+rv:20.0)+Gecko/20100101+Firefox/20.0 500 0 0 374

and also

2013-05-08 14:31:18 127.0.0.1 POST /WebUI/Models/CME/Services/General.svc/GetListCustomPages - 80 HINTTECH:bdommelen 127.0.0.1 - 500 0 0 124

The WebGUI site itself has no problems with the new authentication settings (I can also verify that the LDAP authentication itself is working as I get the login prompt and entering non-valid credentials gives me the 401 error). Another sample from the IIS logs:

2013-05-08 14:30:55 172.16.188.4 GET /WebUI/Editors/CME/Themes/Carbon/Images/Icons/mc.error.16x16.png - 443 - 95.128.91.188 Mozilla/5.0+(Windows+NT+6.0;+WOW64;+rv:20.0)+Gecko/20100101+Firefox/20.0 401 0 0 249

2013-05-08 14:30:56 172.16.188.4 GET /WebUI/Editors/CME/Themes/Carbon/Images/Icons/mc.error.16x16.png - 443 HINTTECH:bdommelen 95.128.91.188 Mozilla/5.0+(Windows+NT+6.0;+WOW64;+rv:20.0)+Gecko/20100101+Firefox/20.0 200 0 0 46

The above shows the normal 401/200 responses for one of the icons of the WebGUI.

I had gone over every inch of the web.config configurations in WebUI, WebRoot and TCM54 until I decided to have a look at the error message details in Firebug which has lots of the following in it:

"StackTrace":" at Tridion.ContentManager.Interop.TDS.TDSEClass.get_User()\u000d\u000a at Tridion.Web.UI.Models.TCM54.WCFServiceBase.LocalizedException(Exception ex)\u000d\u000a at Tridion.Web.UI.Models.TCM54.R5WSImpl.GetUserSettings()\u000d\u000a at Tridion.Web.UI.Models.TCM54.General.GetUserSettings()\u000d\u000a at SyncInvokeGetUserSettings(Object , Object[] , Object[] )\u000d\u000a at System.ServiceModel.Dispatcher.SyncMethodInvoker.Invoke(Object instance, Object[] inputs, Object[]& outputs)\u000d\u000a at System.ServiceModel.Dispatcher.DispatchOperationRuntime.InvokeBegin(MessageRpc& rpc)\u000d\u000a at System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage5(MessageRpc& rpc)\u000d\u000a at System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage41(MessageRpc& rpc)\u000d\u000a at System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage4(MessageRpc& rpc)\u000d\u000a

indicating that the problem is on the server side in some WCF call. So I looked at TcmServiceHost.exe.config (strangely enough not mentioned in either the 2011SP1 or 2013 LiveContent docs) and found that there are two places that refer to LDAP authentication:

<!-- For LDAP authentication of message credentials, use the following settings: -->
<security mode="Message">
<message clientCredentialType="UserName" />
</security>

<!-- The LdapAuthorizationPolicy policy is required for LDAP authentication -->
<!-- <serviceAuthorization>
<authorizationPolicies>
<add policyType="Tridion.Security.IdentityModel.LdapAuthorizationPolicy, Tridion.Security, Version=6.1.0.25, Culture=neutral, PublicKeyToken=ddfc895746e5ee6b" />
</authorizationPolicies>
</serviceAuthorization> -->

I had naturally uncommented both sections but unfortunately the second one poses a problem:

Could not load type 'Tridion.Security.IdentityModel.LdapAuthorizationPolicy' from assembly 'Tridion.Security, Version=6.1.0.25, Culture=neutral, PublicKeyToken=ddfc895746e5ee6b'.

Apparently there is no LdapAuthorizationPolicy in Tridion.Security (I've verified this in Reflector). I've tried the only class that implements IAuthorizationPolicy (ClaimsPrincipalAuthorizationPolicy) but that didn't help so I've ended up commenting out the part again (which removes the event log error above but does not solve my 500 error).

All of the journey above leaves me with three questions:
1. Is the LdapAuthorizationPolicy class needed for the CoreService and how where do I find it if so?
2. Is my conclusion that the CoreService is not properly picking up the authentication context from the request correct or is the problem somewhere else?
3. Has anyone completed a similar setup succesfully and what were the steps that needed to be taken on top of the available documentation?

TcmServiceHost.exe.config [1]: http://sdllivecontent.sdl.com/LiveContent/content/en-US/SDL_Tridion_2011_SPONE/task_INSHYP2DDAFF2CF95E4430AA0F27AD7A91B5F8#addHistory=true&filename=Appendix_ConfiguringLDAP.xml&docid=concept_73740A48A83A4D9E8EF0DAEEFF9A00F3&inner_id=&tid=&query=&scope=&resource=&eventType=lcContent.loadDocconcept_73740A48A83A4D9E8EF0DAEEFF9A00F3

  • I set up a similar environment recently, albeit without https, see: tridion.stackexchange.com/questions/877/… Do you have NT AUTHORITY\NETWORK SERVICE configured as a directory service impersonation user? – oic May 8 '13 at 16:29
  • Yes. And I've also verified that the LDAP is being queried and authentication takes place. The problem is that sometimes no impersonation is being performed afaict specifically when the WebGUI connects to the CoreService... – Bjørn van Dommelen May 8 '13 at 16:34
  • +1 for a well-written question. Plenty of detail in the "Tell us what you've tried" department. – Dominic Cronin May 9 '13 at 7:31
  • Found this on the old forum: forum.sdltridion.com/topic.asp?TOPIC_ID=7588 and the problem is indeed resolved if I switch to .Net 2.0! – Bjørn van Dommelen May 14 '13 at 6:26
1

We had faced the same issue and like you we had also verified most of the things and they were all in place. Then we raised it with the SDL Tridion Support and after extensive WebEx session with the Support span over days, we figured out the issue was with the LDAP Directory Configuration.

I am not sure if it is going to be the same issue with you (LDAP Directory), but it might make sense to contact SDL Support and work in collaboration with them.

This happened with us only when we have installed it with HTTPS, with HTTP although it worked absolutely fine, may be you want to give it a try by configuring for HTTP.

I hope it helps

  • Can you let me know what change have you done to fix this issue ? – user1357019 Nov 1 '13 at 3:15
  • The installation and configuration of LDAP on the server was incorrect, we reconfigured the LDAP on server and it starts working then...nothing to do with the SDL Tridion in our case – Pankaj Gaur Nov 1 '13 at 4:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.