1

In SDL Web 8.5, I implemented a simple-ish HTTPModule that bridges the CME with ADFS 2016 (using SAML) and provides the SSO UserId request header to the CME web applications. This works fine.

I'm now attempting to connect to CoreService (or TemplateBuilder), but so far with little success. I read several posts about running CoreService behind an SSO proxy that exposes a basic auth endpoint. I see such proxy in the CME, but I can't any information about it.

Also I see people had success running the services in mixed authentication mode (using traditional Windows or Integrated security). That is not an option to me, since the Active Directory is not available to the CME server.

What options do I have? Has anybody implemented some kind of token mechanism in front of CM services to relay the UserId SAML claim from ADFS to CoreService for example? Is this path viable? Any other ideas/concerns?

  • You said "In SDL Web 8.5, I implemented a simple-ish HTTPModule that bridges the CME with ADFS 2016 (using SAML) and provides the SSO UserId request header to the CME web applications. This works fine.". Appreciate if you please share your implemented code. Thanks. – Kris Rakshit May 31 '18 at 12:08
  • It took a long time, but finally I have managed to secure the CME and all stack of CM services against ADFS. More info yatb.mitza.net/search/label/ADFS – Mihai Cădariu Sep 13 '18 at 18:37
  • @MihaiCădariu could you please explain where we do config custom http module is that on ADFS server or in CME ? Any reference links to Custom HTTP Module really helps me to check the possibility , Thanks – USER1287 Apr 9 at 3:24
1

We did use OpenAm SSO setup for Content Manager authentication.

Excluded the core services and templates from OpenAM SSO authentication and enabled LDAP authentication it works.

In [Tridion-Home]\webservices\Web.config

 <system.webServer>
    <modules>
      <remove name="SsoAgentHttpModule" />
      <remove name="OpenAmModule64" />
      <!-- This must be enabled for transport-level LDAP authentication and disabled in other cases -->
      <add name="LdapAuthenticationHttpModule" type="Tridion.Security.Web.LdapAuthenticationHttpModule, Tridion.Security, Version=8.5.0.60, Culture=neutral, PublicKeyToken=ddfc895746e5ee6b" />
      <!-- -->
      <!-- This must be enabled for transport-level SSO authentication and disabled in other cases -->
      <!--
      <add name="SsoAgentHttpModule" type="Tridion.Security.Web.SsoAgentHttpModule, Tridion.Security, Version=8.5.0.60, Culture=neutral, PublicKeyToken=ddfc895746e5ee6b" />
      -->
    </modules>
    <handlers>
      <!-- We want to make sure that the .NET 4.0 version of the Svc-Integrated handler is handling our request for WCF service extensions. The old handler could be first in the ordered list, therefore remove it -->
      <remove name="svc-Integrated" />
    </handlers>
    <validation validateIntegratedModeConfiguration="false" />
  </system.webServer>

Setting up Content Manager for LDAP

Edit Updated1:

Did you configure anything else?

No, but worth double check the https configuration [Tridion-Home]\SDL Web\bin\Configuration Scripts\SetupHTTPS.ps1 - I'm not sure it's applicable to your setup.

Where is the authentication coming in LDAP?

The system connected with AD domain but you can configure Directory Services in Tridion Console.

Did you set up that up in the Tridion Management snap-in?

Only for Single Sing On for Username Header value.

I hope it helps.

  • Very interesting. I'll give it a try. Did you configure anything else? Where is the authentication coming in LDAP? Did you setup that up in the Tridion Management snap-in? – Mihai Cădariu Mar 22 '18 at 8:04
  • Updated my answers – Velmurugan Mar 22 '18 at 13:42
  • It took a long time, but finally I have managed to secure the CME and all stack of CM services against ADFS. More info yatb.mitza.net/search/label/ADFS – Mihai Cădariu Sep 13 '18 at 18:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.