Publishing via Core Service

Question

Using the Tridion 2011 Event System I have some code that modifies a text file whenever a Page is published.

If I set a page to publish via the Content Manager the code runs fine.

If I set a page to publish via Core Service it doesn't work. Looking at the Tridion event log on my Content Manager Server I get an error

Access to the path '\\server1\folder1\textfile.txt' is denied.

Component: Tridion.ContentManager
Errorcode: 0
User: NT AUTHORITY\NETWORK SERVICE
...

I know the NETWORK SERVICE account does not have access to this share and I'm not sure I want to give it the required Read/Write access. I assume that when publishing via Content Manager the event system code runs under a different user (in my case maybe tcmcoreservice).

Any ideas why it acts differently and how I can solve this? I'm a bit confused.

Update

My endpoint

<endpoint address="http://mydomain.com/webservices/CoreService2011.svc/basicHttp"
    binding="basicHttpBinding" bindingConfiguration="basicHttp"
    contract="Tridion2011CoreService.ICoreService"
    name="basicHttp" />

My binding

<binding name="basicHttp" closeTimeout="00:01:00" openTimeout="00:01:00"
    receiveTimeout="00:10:00" sendTimeout="00:01:00" allowCookies="false"
    bypassProxyOnLocal="false" hostNameComparisonMode="StrongWildcard"
    maxBufferSize="65536" maxBufferPoolSize="524288" maxReceivedMessageSize="65536"
    messageEncoding="Text" textEncoding="utf-8" transferMode="Buffered"
    useDefaultWebProxy="true">
    <readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384"
    maxBytesPerRead="4096" maxNameTableCharCount="16384" />
    <security mode="TransportCredentialOnly">
        <transport
            clientCredentialType="Windows"
            proxyCredentialType="None"
            realm="" />
        <message clientCredentialType="UserName" algorithmSuite="Default" />
    </security>
</binding>

And to confirm I am using CoreServiceClient

using (var client = new CoreServiceClient())
{
    ... publish code here ...
}

Answer 1

I think this is what happens: You are using the Core Service through the Net TCP binding so the Core Service call is handled by the Tridion Content Manager Service Host process. Also the publish event is executed by this process. The Tridion Content Manager Service Host is running as the Network Service user and this user has no access to the textfile.

When you publish through the Content Manager Explorer or the Core Service over the HTTP binding the publishing action is initiated by the IIS webserver. Apperantly the Tridion application pool is running as a different user which does have access to the textfile.

So the solution could be either

• Change the Tridion Content Manager Service Host process to run as another user.
• Use the HTTP binding instead of the Net TCP binding.

I think in general it would be preferred to have the Tridion application pool and the Tridion Content Manager Service Host process running as the same user so both have the same rights.

Answer 2

Try impersonating the current logged in user in the Core Service code. I had the same problem and Nuno provided the solution here

Code:

client.Impersonate(HttpContext.Current.User.Identity.Name);

Answer 3

I solved my problem by using the net.tcp binding instead of the http binding and specifying the user explicitly.

var readerQuotas = new System.Xml.XmlDictionaryReaderQuotas();
readerQuotas.MaxStringContentLength = 2147483647;
readerQuotas.MaxArrayLength = 2147483647;

var binding = new System.ServiceModel.NetTcpBinding();
binding.MaxReceivedMessageSize = 2147483647;
binding.ReaderQuotas = readerQuotas;

var endpoint = new System.ServiceModel.EndpointAddress("net.tcp://tridionserver:2660/CoreService/2011/netTcp");

using (var client = new Tridion2011CoreService.CoreServiceClient(binding, endpoint))
{
    client.ChannelFactory.Credentials.Windows.ClientCredential = new System.Net.NetworkCredential("myusername", "mypassword");

    ...