3

We have a Tridion 9.6 environment with Access Management and an Identity Provider to connect it to Azure AD for (OpenID) authentication. This is working okay, but since we implemented this, the link between Topology Manager and the content manager is broken. When we try to map a publication to a webapplication in TTM (either through Add-TtmMapping or via the CME), we get this error:

Tridion.TopologyManager.TopologyManagerException: Item of type 'MappingData' can not be saved. Unable to connect to 'net.tcp://localhost:2660' using authentication type 'Windows'. ---> System.ServiceModel.FaultException`1[Tridion.ContentManager.CoreService.Client.CoreServiceFault]: You do not have permission to perform this action.

Our CM environment (what you get when you type get-ttmcmenvironment) looks like this:

CoreServiceRootUrl     : net.tcp://localhost:2660
WebsiteRootUrl         : http://MYCOMPUTER:80
CoreServiceCredentials : "AuthenticationType":"Windows", "UserName":"MYCOMPUTER\TridionUser", "Password":"********"
Id                     : dev
ExtensionProperties    : {}

It seems simple: TTM is trying to connect with a windows user, but Tridion no longer allows this method of authentication because we enabled access management.

How can we fix this?

Improve this question

1 Answer 1

Reset to default
4

Indeed, Topology Manager is still configured to use Windows Authentication on the Core Service. This means you will need to allow mixed-mode authentication for the WCF Core Service. This can be done by enabling both "Anonymous" and "Windows" on the webservices Web App in IIS.

Correction: Topology Manager uses the Core Service net.tcp endpoint, so no need/use in changing the Authentication mode for the webservice Web App (which only handles the HTTP-based endpoints). The net.tcp endpoints should always support Windows Authentication; they are not affected by the Access Management integration.

The error message you get is "You do not have permission to perform this action.", which is an error message returned by the CM Core (also check your Tridion Event Log). This implies that authentication was successful, but authorization failed. Please check if MYCOMPUTER\TridionUser is still an enabled CM account and whether the account has sufficient privileges/rights to read all Publications.

The Stack Trace in the Tridion Event Log may also provide more insight in where it fails exactly.

Improve this answer
3
  • I always thought that the Tridion system user was not supposed to have any rights within Tridion, because it is set up as an impersonation user. Was I wrong about that?
    – Quirijn
    Commented Jul 10, 2023 at 8:34
  • It depends. You can use the Core Service API through direct authentication or through impersonation (using the Core Service Impersonate API). In the latter case, the authenticated user/service account must be configured as CM impersonation user. If you want to enforce impersonation, you can ensure that the authenticated user/service account itself does not have (direct) access to CM. In case of Topology Manager, direct authentication is used, so the service account configured in Topology Manager must have sufficient access to CM.
    – Rick Pannekoek
    Commented Jul 11, 2023 at 7:57
  • You were correct, there was an issue with the MTSUser / TridionUser.
    – Quirijn
    Commented Jul 13, 2023 at 16:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.