Is it necessary to add an impersonation user record to TRUSTEES?

Question

This is the first time to post a question to StackExchange.

Could you please help me about configuration of LDAP? Now I'm configuring LDAP at Tridion 2013 on Windows 2008. I have already done the followings according to Tridion installation manual.

1. changed Authentication settings of IIS.
2. modified a web.config file which was located in the web\ subfolder.
3. modified a web.config file which was located in the web\WebUI\WebRoot subfolder.
4. modified a web.config file which was located in the webservices subfolder.
5. configured a Directory Services
6. deselected 'GroupSync Enabled' to disable group synchronization because I'm setting up development environment.
7. changed a User Type of the impersonation user setting to 'Directory Service'.
8. applied LDAP configuration changes by restarting IIS, COM+ and Windows services.

After that, I could login Tridion Content Management Console, but there was error message in message center of TCME.

Access is denied for the user NT AUTHORITY\NETWORK SERVICE.

There was the following error in event log.

Access is denied for the user NT AUTHORITY\NETWORK SERVICE.


Component: Tridion.ContentManager.CoreService
Errorcode: 770
User: NT AUTHORITY\NETWORK SERVICE

StackTrace Information Details:
   場所 Tridion.ContentManager.Security.AuthorizationManager.LoadAccessToken(String userName, IEnumerable`1 mappedGroupUris, IEnumerable`1 claimSets)
   場所 Tridion.ContentManager.Security.AuthorizationManager.LoadAccessToken(String userName, String impersonationUserName)
   場所 Tridion.ContentManager.Session..ctor(String userName, String impersonationUserName)
   場所 Tridion.ContentManager.CoreService.CoreServiceBase.Impersonate(String userName)
   場所 SyncInvokeImpersonate(Object , Object[] , Object[] )
   場所 System.ServiceModel.Dispatcher.SyncMethodInvoker.Invoke(Object instance, Object[] inputs, Object[]& outputs)
   場所 Tridion.ContentManager.CoreService.CoreServiceInvoker.Invoke(Object instance, Object[] inputs, Object[]& outputs)
   場所 System.ServiceModel.Dispatcher.DispatchOperationRuntime.InvokeBegin(MessageRpc& rpc)
   場所 System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage5(MessageRpc& rpc)
   場所 System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage31(MessageRpc& rpc)
   場所 System.ServiceModel.Dispatcher.MessageRpc.Process(Boolean isOperationContextSet)

So I added an impersonation user record 'NT AUTHORITY\NETWORK SERVICE' to TRUSTEES table. As a result, the error message disappeared. But Tridion said 'Welcome, NT AUTHORITY\NETWORK SERVICE' although I logged in as administrator user.

Is it necessary to add an impersonation user record to TRUSTEES? If answer is 'No', why does not Tridion say 'Welcome, Tridion Content Management Administrator'?

I have already checked this post Unable to Initialize TDSE object when using LDAP, but I couldn't resolve this problem.

Could you please help me, again?

Answer 1

The impersonation user does not have to be added to the TRUSTEES table, but rather in the SDL Tridion Configuration MMC Snap In. That's way easier anyway. ;)

You can read about this in the manual and here as well. (login required)

The short version is:

1. Start the SDL Tridion MMC Snap-in by selecting Programs > SDL Tridion > SDL Tridion Content Manager configuration in the Microsoft Windows Start menu.
2. In the SDL Tridion MMC Snap-in, right-click on the Impersonation User icon and select New Impersonation User.
3. Under Windows User, enter the name of the impersonation user used by the Web site. This impersonation user is associated with the NETWORK SERVICE account, and can be configured in the SDL Tridion MMC Snap-in.