2

Is it possible to disable the use of the Tridion CoreService so that only the native system and administrators can use it? We are a large company with many business areas. As native access to the interface also grants the ability to create a client, we have seen users abuse the system and mass publish/delete/move that have brought the system down. We could limit the basichttp and wshttp through IIS, but the net.tcp endpoint would still be open.

Thoughts?

Thanks in advance!

  • Could a firewall limit traffic to the Core Service externally or would that affect XPM too? – Neil Feb 28 at 7:21
3

Well, it all comes down to proper security. Your Core service Endpoint, is just endpoint. It exposes Tridion in a different way. And just like in Tridion GUI, users connect to core service over their own user. So security model is applied here also. If they cannot create publications over GUI, they won't be able to do so over Core Service either. So you should work on setting security model properly, not shutting down Core Service.

OK so here is my update. What you basically want is to let users use Core Service, but not how they want, but how you want. So you have a system which is not appropriate for your users. They should be the focus of your system, so if its not coping with user activities, scale it out. HOW? Well for start, scale Content Manager machine. Have one more, where you will open only Core Service endpoint, without GUI, and let them use that machine for abusing the system. Your old CM will stay for manual activities and will be relieved without Core Service connection requests.

Other option is to have some sort of tracking system which tracks number of connections and actions per user in certain period of time, but for this you should have combination of event system that tracks changes and sends it to external data storage that analyze it... Honestly I wouldn't even go there....

  • Our security model is locked down. Our issue is coming in when users are loading/deleting/moving content that they already have access to do in the interface. The scale that they can do it with in CoreService is what we want to lock down. – Trevor Bartlett Mar 1 at 16:32
  • i have added my update. – Marko Milic Mar 2 at 16:03
  • You are right. We will let it be and scale up/out if needed. – Trevor Bartlett Mar 5 at 16:47
2

For most use cases, access to the Core Service’s net.tcp endpoints is done from the same machine. For example, the CME back-end typically connects to the Core Service’s net.tcp endpoints on net.tcp://localhost:2660.

So, you will get quite far by closing down port 2660 on your CMS Server’s firewall; this will normally not interfere with operation of the standard CMS subsystems. On the other hand, it will make it impossible to access the Core Service’s net.tcp endpoints if you are not on the CMS server.

  • Similar to @Neil, I am going to look into Windows Firewall to see if this is configurable for an inbound rule that is not coming from local. – Trevor Bartlett Mar 1 at 16:46
1

Yes - you can do various things to prevent people using the core service, but I fear your problem is not a technical one, but a management or communication one. Given access to the Tridion GUI, a reasonably savvy user can create huge publishing jobs. They can also delete and move things. So if you deny them the use of the core service, you may perhaps not succeed in solving your problem.

Talk to your users.

You should probably compliment them on how they've managed to use the core service to solve their day-to-day problems. As others have noted, basic security allows you to dictate which actions a user may perform, but does not prevent that user from automating those actions. Sure - you could implement customisations to prevent a given user performing more than a certain amount of actions, but why?

Your basic problem is to share out fairly access to a limited resource. Your end-users don't want extra restrictions. Trust me on that. If you get them together and explain that they need to share better, or you'll need to impose restrictions, they will be very glad to have the chance to work together better.

If, after everyone getting their heads together, the conclusion is that Tridion just needs to perform better, then be happy. Tridion's architecture is just about as scaleable as you can imagine. If you need to add extra servers, Tridion will cope just fine. All you need to do is assemble the business case, make a plan and execute on it. Tridion will cope.

0

You cannot disable Core Services completely. It is needed for various SDL CM and XPM modules.

You can configure Core Services for windows authentication while having your Content manager work with LDAP or SSO. I am hoping that your business areas will NOT have valid windows and SDL accounts for them too configured.

You will find the configuration @ TRIDION_HOME\web\WebUI\WebRoot and also @ TRIDION_HOME\webservices folder. If you have no experience modifying the files, I suggest you open a how-to question with SDL support so that you can get the official documentation.

  • We use Windows AD for authentication, so unfortunately I do not think this will not work. – Trevor Bartlett Feb 27 at 22:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.