Impersonation User while using Core Service

Question

I am trying to use the Core Service client for publishing a Page. Below is the code.

var client = new SessionAwareCoreServiceClient("netTcp_2013");
client.Impersonate("domain\impuser");

But, when my user domain\testuser logs into the CMS server and runs the exe, he is getting an error message:

"Impersonation by domain\testuser user requires the account to be configured as impersonation user."

I found that we need to add domain\testuser to impersonation user in Tridion configuration. The scenario now is we have another server where this is already running and I don't see any users added under impersonation user. When we log in using domain\testuser there is no error and it runs without any issue. But not in the case of my server. My question is, other than adding user under impersonation user in Tridion MMC is there any other way impersonation could be achieved as I see this running without any issues in another server?

Thanks for help.

Answer 1

When you impersonate, you adopt the identity of a Tridion trustee. Obviously the ability to do this must be carefully controlled, so only specifically configured Windows accounts are allowed to do this. When you create an "impersonation user" you are specifying that the given account is allowed to impersonate Tridion trustees.

When you call client.Impersonate("someUser") you are asking to "become" that user. i.e. any further interactions with the service will take place as that user. To do this, the account you are connecting with will need to be configured as an impersonation user on the server you are connecting to.

Answer 2

Your question supplies the following information:

• Your Core Service client application tries to impersonate to user domain\impuser
• Your Core Service client application is executed under the user domain\testuser
• This doesn't work on "your" server, but works on "another" server

Following Dominic's answer, for your scenario to work correctly you should have the following setup:

• The user domain\impuser should be a valid Tridion trustee in the CMS
• The user domain\testuser should be listed as a Impersonation User in the Tridion MMC

You unfortunately don't specify which user accounts are listed as Tridion trustees in the two different CMS servers. Yet you also indicate that there are no Impersonation Users configured on either machine, which is strange.

For impersonation to work, you must configure an Impersonation User in the Tridion MMC, if that is not done, then you will get an error when you call client.Impersonate(). So your question seems to be missing some valuable information (I suggest you edit your question and update it, so you can get a better answer). If you want it to work without impersonation all together, you should simply run the Core Service client application under the identity of a valid Tridion trustee (and not call client.Impersonate()).

My guess is that on the "other" server, your Core Service client application does not call impersonate, and is executed by a valid Tridion trustee, which is why it works.