We have an application using Core Services to access/update data in Tridion Web 8.5. The requirement is to ensure that username/password is not passed explicitly in config.

Is it possible to set integrated="true" for the config in our application? Example: Instead of

<CoreServiceConfiguration bindingType="XYZHttp_TH" 
                          streamUploadBindingType="streamUpload_basicHttp_TH" 
                          userName="AbCd\custadmin" 
                          password="jgjhfgkdgfd">

Can we write:

<CoreServiceConfiguration bindingType="XYZHttp_TH" 
                          streamUploadBindingType="streamUpload_basicHttp_TH" 
                          integrated="true">

If so what all changes would be required in our code base to accommodate this change?

Any help would be really appreciated. TIA

up vote 1 down vote accepted

No, It's not possible, It needs credentials to connect to the core service.

Maybe if your core service will be deployed in SDL Web application itself then you could use Impersonate to the current user without passing the credentials details.

  var mClient = new SessionAwareCoreServiceClient("wsHttp_2013");
  mClient.Impersonate(HttpContext.Current.Request.LogonUserIdentity.Name);

Updated: You could consider encrypting the password on the web.config

Setting up encryption and decryption of sensitive values in the .Net application

I hope it helps

  • Thank you Velmurugan. Our application is not deployed in SDL Web application, but is a separate service that is creating/updating content in our SDL Web application. It will not be possible to use "Impersonate" in our case, we would then have to pass the username and password in the config as we are currently doing. – guest_2017 Oct 4 at 7:21
  • Yes, You could consider encrypting the credentials, Updated my answer – Velmurugan Oct 4 at 8:32
  • Thank you Velmurugan. Yes, that's what we had planned to go ahead with, in case it is NOT possible to set integrated="true" for the config. – guest_2017 Oct 4 at 10:56

It's possible, provided that you use something that doesn't require the use of usernames and passwords (e.g. if you use Windows authentication instead of Basic).

If you ensure that the current thread user is the same user you wish to connect with, you can use default credentials when connecting. That way you do not have any passwords in your configuration.

  • In our application, a specific user is required to run the app. The user ID/PWD details are configured as the application is hosted as a windows service. So, we cannot use basic Windows authentication. – guest_2017 Oct 4 at 10:51
  • I'm sorry, but this doesn't make any sense to me. You asked if you could use 'integrated' -- that's Windows authentication, last I checked. Then you're saying that you have to keep your custom configuration -- but your question was about if there are any ways to not have to specify the username and password when talking to the Core Service from SDL. There are multiple ways to do so and I presented the most common one -- but if you have to use Basic Authentication then it also follows that you have to specify a username and password somehow. The 'somehow' is up to you, as it is your code. – Peter Kjaer Oct 5 at 9:18
  • I might have mis-interpreted your explanation. Apologies if my reply was confusing. What I meant is, the service uses a specific user to make changes to SDL. However, any user logged in to the server can start or stop the service. However, the service still runs using that specific user ID/PWD it is configured with, in the 'Log on as' user. – guest_2017 Oct 5 at 9:29

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.