Tridion Stack Exchange is a question and answer site for Tridion developers and administrators. It only takes a minute to sign up.
Sign up to join this community
Is it possible to disable the use of the Tridion CoreService so that only the native system and administrators can use it? We are a large company with many business areas. As native access to the interface also grants the ability to create a client, we have seen users abuse the system and mass publish/delete/move that have brought the system down. We could limit the basichttp and wshttp through IIS, but the net.tcp endpoint would still be open.
Thoughts?
Thanks in advance!
Well, it all comes down to proper security. Your Core service Endpoint, is just endpoint. It exposes Tridion in a different way. And just like in Tridion GUI, users connect to core service over their own user. So security model is applied here also. If they cannot create publications over GUI, they won't be able to do so over Core Service either. So you should work on setting security model properly, not shutting down Core Service.
OK so here is my update. What you basically want is to let users use Core Service, but not how they want, but how you want. So you have a system which is not appropriate for your users. They should be the focus of your system, so if its not coping with user activities, scale it out. HOW? Well for start, scale Content Manager machine. Have one more, where you will open only Core Service endpoint, without GUI, and let them use that machine for abusing the system. Your old CM will stay for manual activities and will be relieved without Core Service connection requests.
Other option is to have some sort of tracking system which tracks number of connections and actions per user in certain period of time, but for this you should have combination of event system that tracks changes and sends it to external data storage that analyze it... Honestly I wouldn't even go there....
For most use cases, access to the Core Service’s net.tcp endpoints is done from the same machine. For example, the CME back-end typically connects to the Core Service’s net.tcp endpoints on net.tcp://localhost:2660.
So, you will get quite far by closing down port 2660 on your CMS Server’s firewall; this will normally not interfere with operation of the standard CMS subsystems. On the other hand, it will make it impossible to access the Core Service’s net.tcp endpoints if you are not on the CMS server.
Yes - you can do various things to prevent people using the core service, but I fear your problem is not a technical one, but a management or communication one. Given access to the Tridion GUI, a reasonably savvy user can create huge publishing jobs. They can also delete and move things. So if you deny them the use of the core service, you may perhaps not succeed in solving your problem.
Talk to your users.
You should probably compliment them on how they've managed to use the core service to solve their day-to-day problems. As others have noted, basic security allows you to dictate which actions a user may perform, but does not prevent that user from automating those actions. Sure - you could implement customisations to prevent a given user performing more than a certain amount of actions, but why?
Your basic problem is to share out fairly access to a limited resource. Your end-users don't want extra restrictions. Trust me on that. If you get them together and explain that they need to share better, or you'll need to impose restrictions, they will be very glad to have the chance to work together better.
If, after everyone getting their heads together, the conclusion is that Tridion just needs to perform better, then be happy. Tridion's architecture is just about as scaleable as you can imagine. If you need to add extra servers, Tridion will cope just fine. All you need to do is assemble the business case, make a plan and execute on it. Tridion will cope.
You cannot disable Core Services completely. It is needed for various SDL CM and XPM modules.
You can configure Core Services for windows authentication while having your Content manager work with LDAP or SSO. I am hoping that your business areas will NOT have valid windows and SDL accounts for them too configured.
You will find the configuration @ TRIDION_HOME\web\WebUI\WebRoot and also @ TRIDION_HOME\webservices folder. If you have no experience modifying the files, I suggest you open a how-to question with SDL support so that you can get the official documentation.
