We have integrated one of our Tridion Content Manager server (version = Tridion 2011 SP1 HR2 on Windows 2003 R2 SP2 with IIS 6) with single sign-on (SSO) authentication.
To do that, we have followed the instructions found here. We have configured a reverse proxy in front of the Tridion Content Manager server to authenticate users then user ids are forwarded in a HTTP header.
After few tests, everythings seems to work well for the Content Manager itself. But we have issues when we want to access to the Core Service or when we want to use webdav.
Ex : In a web browser, we are no more able to display the wsdl of the Core Service :
- if we type
http://tridion_server_URL/webservices/CoreService2011.svc?wsdlthen we have the following error message : "No SSO user name (USER_NAME) specified in the request"
- if we type
http://reverse_proxy_URL/webservices/CoreService2011.svc?wsdlthen the server is asking for a user/password
After investigations we've found that in IIS, the security settings for /webservices are still configured with "Integrated Windows Authentication" enabled. And same for /webdav.
When we changed the security settings for the SDL Tridion 2011 Web site, the system found a lot of inheritance overrides. /webservices & /webdav were amongst them. As described in the documentation, we just clicked "ok" without selecting any items.
Click OK to commit these changes, and in the Properties dialog that reappears, OK to return to IIS Manager.
What is the impact to manually update the security settings for /webservice and /webdav ? Do we have to apply the new security configuration for all inheritance overrides found ?
Thanks for your help