We have been having a strange issue with core services. Our application uses Angular as the front end and ASP.NET for back end. The back end api service connects to Tridion using core services. The Application and Tridion core services are running in different servers.

The issue we are having is that the application when accessed locally on the servers works fine. But accessing the application remotely throws an error. This error is thrown when client.Impersonate("Windows Account") is called. The "Windows Account" is present in Tridion Users. But the same code works well when running the application locally on the server.

The application uses ApplicationPoolIdentity for Identity and uses Windows authentication.

There only time the application works remotely is when we configure Tridion Impersonation Account in Identity. If I remove the account it does not work.

Did anyone else have this issue? Any insight to this issue is appreciated.

enter image description here

  • I'm almost afraid to ask... but this is not a front-end/web-facing web application we're talking about, right? It's for internal editors only, right?
    – Nuno Linhares
    Aug 8 '18 at 16:43
  • 1
    @NunoLinhares .. yes you are correct. It is an intranet application. Not a public facing web application.
    – S P
    Aug 8 '18 at 17:36
  • Try configuring the machine account (<domain>\<hostname>$) as Tridion Impersonation User. In general, Application Pool Identities are represented as the machine account for accessed to network resources. See docs.microsoft.com/en-us/iis/manage/configuring-security/… Aug 8 '18 at 19:35
  • @S P thanks. We’ve seen a case recently where a website was calling the coreservice, I guess I’m still traumatized. Rick’s answer is the right one.
    – Nuno Linhares
    Aug 9 '18 at 6:28
  • 1
    @Nuno, headless CMS done wrong? ;)
    – Atila Sos
    Aug 9 '18 at 7:08

Try configuring the machine account (<domain>\<hostname>$) of the web app server as Tridion Impersonation User.

In general, Application Pool Identities are represented as the machine account for access to network resources. See https://docs.microsoft.com/en-us/iis/manage/configuring-security/application-pool-identities#accessing-the-network

  • thank you for your reply. The IT team is requesting not to use Tridion Impersonation User. The application is working fine when run locally on the server itself with out Tridion Impersonation Account setup. The problem is when accessing the web application from any other machine.
    – S P
    Aug 9 '18 at 19:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.