8

We have a Content Manager hosted in a internal subnet. Internal contributors are able to access to it perfectly from the enterprise network (intranet).

Now we have been asked to provide a way to access it externally from the internet. One constraint is to propose a solution as simple as possible and to avoid to use advanced solutions as VPNs for example. The final goal is to be able to give accesses on demand to contractors (web agencies, communication agencies, etc) and to propose a simple interface for crisis communication (available from everywhere on every kind of device).

In the past, I worked on the same scenario with Tridion 5.3. The solution we found was to configure a reverse proxy in DMZ in front of the Content Manager. To deal with the authentication, we were forced to switch the authentication mechanism in IIS from "Windows authentication" to "Basic authentication" (NTLM authentication handshakes seem not compatible with the use of a reverse proxy). Of course we were putting in place encryption mechanism (between users and the Reverse Proxy + if needed between the Reverse Proxy and the Content Manager server).

I've tried to put in place the same scenario with Tridion 2011 SP1 RH1 but unsuccessfully. If I switch the authentication mechanism to "Basic Authentication", the following error is raised when trying to login to the Content Manager : "Failed to load your user preferences. The default system values will be used".

In the event viewer I can found the following message:

WebHost failed to process a request. Sender Information: System.ServiceModel.ServiceHostingEnvironment+HostingManager/7688875 Exception: System.ServiceModel.ServiceActivationException: The service '/WEBUI/Models/TCM54/Services/General.svc' cannot be activated due to an exception during compilation. The exception message is: Security settings for this service require Windows Authentication but it is not enabled for the IIS application that hosts this service.. ---> System.NotSupportedException: Security settings for this service require Windows Authentication but it is not enabled for the IIS application that hosts this service. at System.ServiceModel.Activation.HostedAspNetEnvironment.ValidateHttpSettings(String virtualPath, Boolean isMetadataListener, Boolean usingDefaultSpnList, AuthenticationSchemes& supportedSchemes, ExtendedProtectionPolicy& extendedProtectionPolicy, String& realm) at System.ServiceModel.Channels.HttpChannelListener.ApplyHostedContext(String virtualPath, Boolean isMetadataListener) at System.ServiceModel.Activation.HostedAspNetEnvironment.ApplyHostedContext(TransportChannelListener listener, BindingContext context) at System.ServiceModel.Channels.HttpTransportBindingElement.BuildChannelListener[TChannel](BindingContext context) at System.ServiceModel.Channels.BindingContext.BuildInnerChannelListenerTChannel at System.ServiceModel.Channels.MessageEncodingBindingElement.InternalBuildChannelListener[TChannel](BindingContext context) at System.ServiceModel.Channels.WebMessageEncodingBindingElement.BuildChannelListener[TChannel](BindingContext context) at System.ServiceModel.Channels.BindingContext.BuildInnerChannelListenerTChannel at System.ServiceModel.Channels.Binding.BuildChannelListener[TChannel](Uri listenUriBaseAddress, String listenUriRelativeAddress, ListenUriMode listenUriMode, BindingParameterCollection parameters) at System.ServiceModel.Description.DispatcherBuilder.MaybeCreateListener(Boolean actuallyCreate, Type[] supportedChannels, Binding binding, BindingParameterCollection parameters, Uri listenUriBaseAddress, String listenUriRelativeAddress, ListenUriMode listenUriMode, ServiceThrottle throttle, IChannelListener& result, Boolean supportContextSession) at System.ServiceModel.Description.DispatcherBuilder.BuildChannelListener(StuffPerListenUriInfo stuff, ServiceHostBase serviceHost, Uri listenUri, ListenUriMode listenUriMode, Boolean supportContextSession, IChannelListener& result) at System.ServiceModel.Description.DispatcherBuilder.InitializeServiceHost(ServiceDescription description, ServiceHostBase serviceHost) at System.ServiceModel.ServiceHostBase.InitializeRuntime() at System.ServiceModel.ServiceHostBase.OnBeginOpen() at System.ServiceModel.ServiceHostBase.OnOpen(TimeSpan timeout) at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout) at System.ServiceModel.Channels.CommunicationObject.Open() at System.ServiceModel.ServiceHostingEnvironment.HostingManager.ActivateService(String normalizedVirtualPath) at System.ServiceModel.ServiceHostingEnvironment.HostingManager.EnsureServiceAvailable(String normalizedVirtualPath) --- End of inner exception stack trace --- at System.ServiceModel.ServiceHostingEnvironment.HostingManager.EnsureServiceAvailable(String normalizedVirtualPath) at System.ServiceModel.ServiceHostingEnvironment.EnsureServiceAvailableFast(String relativeVirtualPath) Process Name: w3wp Process ID: 14660

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Is it possible to authorize basic authentication for this WS ? Do I have to find another scenario ?

Improve this question

1 Answer 1

Reset to default
6

You should be able to achieve your goal by having a reverse proxy do some kind of authentication and then pass on the authenticated user's name in an HTTP header when proxying the request to the CM server.

You then need to do some configuration on the CM server (I would recommend having a dedicated CM server for external access) including allowing anonymous access.

This is documented under the topic of single-sign-on in the 2011 online documentation [requires login]

Improve this answer
5
  • The scenario you propose is in line with what I want to do. But I can't manage the authentication on the Reverse Proxy side because the Reverse Proxy is in the internet DMZ with no access to the Windows Domain Controller. The authentication must be made on the CM server itself (or another server in the same LAN). I'm wondering if using LDAP authentication (which means Anonymous authentication in IIS according to the link you sent) could help ?
    – Sébastien PRAT
    May 28, 2013 at 10:15
  • It should be easy to try LDAP - and otherwise I am pretty sure you should be able to get a single sign on solution to work somehow, but you may then need to have to proxy through 2 servers, one in the DMZ for access from outside, and one in the internal network (which can do some authentication). From a Tridion point of view its quite simple, just make sure a HTTP header variable contains the username and you are good.
    – Will Price
    May 28, 2013 at 10:43
  • Yes I will try to investigate in those 2 directions. Last question: from a Tridion point of view, how to retrieve the HTTP header variable ? Is there a way to configure it or do I have to write my own isapi filter or other mechanism ?
    – Sébastien PRAT
    May 28, 2013 at 11:23
  • Its built in to the single sign on feature, so you dont have to do anything except specify the header variable name in MMC snap in Single Sign On->User Name Header (if you follow the link at the bottom of the link in my answer you see the settings described there)
    – Will Price
    May 28, 2013 at 11:28
  • Oh sh... I read thrice this page without having seen this link. Thanks a lot Will!
    – Sébastien PRAT
    May 28, 2013 at 12:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.