9

Using the Tridion 2011 Event System I have some code that modifies a text file whenever a Page is published.

If I set a page to publish via the Content Manager the code runs fine.

If I set a page to publish via Core Service it doesn't work. Looking at the Tridion event log on my Content Manager Server I get an error

Access to the path '\\server1\folder1\textfile.txt' is denied.

Component: Tridion.ContentManager
Errorcode: 0
User: NT AUTHORITY\NETWORK SERVICE
...

I know the NETWORK SERVICE account does not have access to this share and I'm not sure I want to give it the required Read/Write access. I assume that when publishing via Content Manager the event system code runs under a different user (in my case maybe tcmcoreservice).

Any ideas why it acts differently and how I can solve this? I'm a bit confused.

Update

My endpoint

<endpoint address="http://mydomain.com/webservices/CoreService2011.svc/basicHttp"
    binding="basicHttpBinding" bindingConfiguration="basicHttp"
    contract="Tridion2011CoreService.ICoreService"
    name="basicHttp" />

My binding

<binding name="basicHttp" closeTimeout="00:01:00" openTimeout="00:01:00"
    receiveTimeout="00:10:00" sendTimeout="00:01:00" allowCookies="false"
    bypassProxyOnLocal="false" hostNameComparisonMode="StrongWildcard"
    maxBufferSize="65536" maxBufferPoolSize="524288" maxReceivedMessageSize="65536"
    messageEncoding="Text" textEncoding="utf-8" transferMode="Buffered"
    useDefaultWebProxy="true">
    <readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384"
    maxBytesPerRead="4096" maxNameTableCharCount="16384" />
    <security mode="TransportCredentialOnly">
        <transport
            clientCredentialType="Windows"
            proxyCredentialType="None"
            realm="" />
        <message clientCredentialType="UserName" algorithmSuite="Default" />
    </security>
</binding>

And to confirm I am using CoreServiceClient

using (var client = new CoreServiceClient())
{
    ... publish code here ...
}
  • I guess you are using the net tcp binding to connect to the Core Service? – Jan H Jun 14 '13 at 11:05
  • @JanH I'm not sure. I just add a Service Reference in Visual Studio and the bindings get set up automatically. I guess I'm using http – Kevin Brydon Jun 14 '13 at 11:49
  • You are using the HTTP binding indeed. – Jan H Jun 14 '13 at 14:13
7

I think this is what happens: You are using the Core Service through the Net TCP binding so the Core Service call is handled by the Tridion Content Manager Service Host process. Also the publish event is executed by this process. The Tridion Content Manager Service Host is running as the Network Service user and this user has no access to the textfile.

When you publish through the Content Manager Explorer or the Core Service over the HTTP binding the publishing action is initiated by the IIS webserver. Apperantly the Tridion application pool is running as a different user which does have access to the textfile.

So the solution could be either

  • Change the Tridion Content Manager Service Host process to run as another user.
  • Use the HTTP binding instead of the Net TCP binding.

I think in general it would be preferred to have the Tridion application pool and the Tridion Content Manager Service Host process running as the same user so both have the same rights.

  • I'm not sure that changing the Tridion application pool user is the right answer, it's using the low priveleged NETWORK SERVICE for a reason presumably? And my Tridion Content Manager Service Host is running as tcmcoreservice as described in the online documentation "Content Manager user accounts" (url is too long to paste) – Kevin Brydon Jun 14 '13 at 12:43
1

Try impersonating the current logged in user in the Core Service code. I had the same problem and Nuno provided the solution here

Code:

client.Impersonate(HttpContext.Current.User.Identity.Name);
  • Will the local filesystem be accessed as the impersonated user (HttpContext.Current.User.Identity.Name) this way? That would mean all Tridion users need access to this share. And given it's a share they might even be able to acess the file from their PC too? – Jan H Jun 14 '13 at 11:28
  • I can't use .Impersonate as I am using CoreServiceClient. I should have mentioned that. – Kevin Brydon Jun 14 '13 at 12:23
1

I solved my problem by using the net.tcp binding instead of the http binding and specifying the user explicitly.

var readerQuotas = new System.Xml.XmlDictionaryReaderQuotas();
readerQuotas.MaxStringContentLength = 2147483647;
readerQuotas.MaxArrayLength = 2147483647;

var binding = new System.ServiceModel.NetTcpBinding();
binding.MaxReceivedMessageSize = 2147483647;
binding.ReaderQuotas = readerQuotas;

var endpoint = new System.ServiceModel.EndpointAddress("net.tcp://tridionserver:2660/CoreService/2011/netTcp");

using (var client = new Tridion2011CoreService.CoreServiceClient(binding, endpoint))
{
    client.ChannelFactory.Credentials.Windows.ClientCredential = new System.Net.NetworkCredential("myusername", "mypassword");

    ...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.