4

We have been having a strange issue with core services. Our application uses Angular as the front end and ASP.NET for back end. The back end api service connects to Tridion using core services. The Application and Tridion core services are running in different servers.

The issue we are having is that the application when accessed locally on the servers works fine. But accessing the application remotely throws an error. This error is thrown when client.Impersonate("Windows Account") is called. The "Windows Account" is present in Tridion Users. But the same code works well when running the application locally on the server.

The application uses ApplicationPoolIdentity for Identity and uses Windows authentication.

There only time the application works remotely is when we configure Tridion Impersonation Account in Identity. If I remove the account it does not work.

Did anyone else have this issue? Any insight to this issue is appreciated.

enter image description here

Improve this question
5
  • I'm almost afraid to ask... but this is not a front-end/web-facing web application we're talking about, right? It's for internal editors only, right?
    – Nuno Linhares ♦
    Commented Aug 8, 2018 at 16:43
  • 1
    @NunoLinhares .. yes you are correct. It is an intranet application. Not a public facing web application.
    – S P
    Commented Aug 8, 2018 at 17:36
  • Try configuring the machine account (<domain>\<hostname>$) as Tridion Impersonation User. In general, Application Pool Identities are represented as the machine account for accessed to network resources. See docs.microsoft.com/en-us/iis/manage/configuring-security/…
    – Rick Pannekoek
    Commented Aug 8, 2018 at 19:35
  • @S P thanks. We’ve seen a case recently where a website was calling the coreservice, I guess I’m still traumatized. Rick’s answer is the right one.
    – Nuno Linhares ♦
    Commented Aug 9, 2018 at 6:28
  • 1
    @Nuno, headless CMS done wrong? ;)
    – Atila Sos
    Commented Aug 9, 2018 at 7:08

1 Answer 1

Reset to default
1

Try configuring the machine account (<domain>\<hostname>$) of the web app server as Tridion Impersonation User.

In general, Application Pool Identities are represented as the machine account for access to network resources. See https://docs.microsoft.com/en-us/iis/manage/configuring-security/application-pool-identities#accessing-the-network

Improve this answer
1
  • thank you for your reply. The IT team is requesting not to use Tridion Impersonation User. The application is working fine when run locally on the server itself with out Tridion Impersonation Account setup. The problem is when accessing the web application from any other machine.
    – S P
    Commented Aug 9, 2018 at 19:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.