We have a Content Manager hosted in a internal subnet. Internal contributors are able to access to it perfectly from the enterprise network (intranet).
Now we have been asked to provide a way to access it externally from the internet. One constraint is to propose a solution as simple as possible and to avoid to use advanced solutions as VPNs for example. The final goal is to be able to give accesses on demand to contractors (web agencies, communication agencies, etc) and to propose a simple interface for crisis communication (available from everywhere on every kind of device).
In the past, I worked on the same scenario with Tridion 5.3. The solution we found was to configure a reverse proxy in DMZ in front of the Content Manager. To deal with the authentication, we were forced to switch the authentication mechanism in IIS from "Windows authentication" to "Basic authentication" (NTLM authentication handshakes seem not compatible with the use of a reverse proxy). Of course we were putting in place encryption mechanism (between users and the Reverse Proxy + if needed between the Reverse Proxy and the Content Manager server).
I've tried to put in place the same scenario with Tridion 2011 SP1 RH1 but unsuccessfully. If I switch the authentication mechanism to "Basic Authentication", the following error is raised when trying to login to the Content Manager : "Failed to load your user preferences. The default system values will be used".
In the event viewer I can found the following message:
WebHost failed to process a request. Sender Information: System.ServiceModel.ServiceHostingEnvironment+HostingManager/7688875 Exception: System.ServiceModel.ServiceActivationException: The service '/WEBUI/Models/TCM54/Services/General.svc' cannot be activated due to an exception during compilation. The exception message is: Security settings for this service require Windows Authentication but it is not enabled for the IIS application that hosts this service.. ---> System.NotSupportedException: Security settings for this service require Windows Authentication but it is not enabled for the IIS application that hosts this service. at System.ServiceModel.Activation.HostedAspNetEnvironment.ValidateHttpSettings(String virtualPath, Boolean isMetadataListener, Boolean usingDefaultSpnList, AuthenticationSchemes& supportedSchemes, ExtendedProtectionPolicy& extendedProtectionPolicy, String& realm) at System.ServiceModel.Channels.HttpChannelListener.ApplyHostedContext(String virtualPath, Boolean isMetadataListener) at System.ServiceModel.Activation.HostedAspNetEnvironment.ApplyHostedContext(TransportChannelListener listener, BindingContext context) at System.ServiceModel.Channels.HttpTransportBindingElement.BuildChannelListener[TChannel](BindingContext context) at System.ServiceModel.Channels.BindingContext.BuildInnerChannelListenerTChannel at System.ServiceModel.Channels.MessageEncodingBindingElement.InternalBuildChannelListener[TChannel](BindingContext context) at System.ServiceModel.Channels.WebMessageEncodingBindingElement.BuildChannelListener[TChannel](BindingContext context) at System.ServiceModel.Channels.BindingContext.BuildInnerChannelListenerTChannel at System.ServiceModel.Channels.Binding.BuildChannelListener[TChannel](Uri listenUriBaseAddress, String listenUriRelativeAddress, ListenUriMode listenUriMode, BindingParameterCollection parameters) at System.ServiceModel.Description.DispatcherBuilder.MaybeCreateListener(Boolean actuallyCreate, Type supportedChannels, Binding binding, BindingParameterCollection parameters, Uri listenUriBaseAddress, String listenUriRelativeAddress, ListenUriMode listenUriMode, ServiceThrottle throttle, IChannelListener& result, Boolean supportContextSession) at System.ServiceModel.Description.DispatcherBuilder.BuildChannelListener(StuffPerListenUriInfo stuff, ServiceHostBase serviceHost, Uri listenUri, ListenUriMode listenUriMode, Boolean supportContextSession, IChannelListener& result) at System.ServiceModel.Description.DispatcherBuilder.InitializeServiceHost(ServiceDescription description, ServiceHostBase serviceHost) at System.ServiceModel.ServiceHostBase.InitializeRuntime() at System.ServiceModel.ServiceHostBase.OnBeginOpen() at System.ServiceModel.ServiceHostBase.OnOpen(TimeSpan timeout) at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout) at System.ServiceModel.Channels.CommunicationObject.Open() at System.ServiceModel.ServiceHostingEnvironment.HostingManager.ActivateService(String normalizedVirtualPath) at System.ServiceModel.ServiceHostingEnvironment.HostingManager.EnsureServiceAvailable(String normalizedVirtualPath) --- End of inner exception stack trace --- at System.ServiceModel.ServiceHostingEnvironment.HostingManager.EnsureServiceAvailable(String normalizedVirtualPath) at System.ServiceModel.ServiceHostingEnvironment.EnsureServiceAvailableFast(String relativeVirtualPath) Process Name: w3wp Process ID: 14660
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Is it possible to authorize basic authentication for this WS ? Do I have to find another scenario ?