3

We have integrated one of our Tridion Content Manager server (version = Tridion 2011 SP1 HR2 on Windows 2003 R2 SP2 with IIS 6) with single sign-on (SSO) authentication.

To do that, we have followed the instructions found here. We have configured a reverse proxy in front of the Tridion Content Manager server to authenticate users then user ids are forwarded in a HTTP header.

After few tests, everythings seems to work well for the Content Manager itself. But we have issues when we want to access to the Core Service or when we want to use webdav.

Ex : In a web browser, we are no more able to display the wsdl of the Core Service :

  1. if we type http://tridion_server_URL/webservices/CoreService2011.svc?wsdl then we have the following error message : "No SSO user name (USER_NAME) specified in the request"
  2. if we type http://reverse_proxy_URL/webservices/CoreService2011.svc?wsdl then the server is asking for a user/password

After investigations we've found that in IIS, the security settings for /webservices are still configured with "Integrated Windows Authentication" enabled. And same for /webdav.

When we changed the security settings for the SDL Tridion 2011 Web site, the system found a lot of inheritance overrides. /webservices & /webdav were amongst them. As described in the documentation, we just clicked "ok" without selecting any items.

Click OK to commit these changes, and in the Properties dialog that reappears, OK to return to IIS Manager.

What is the impact to manually update the security settings for /webservice and /webdav ? Do we have to apply the new security configuration for all inheritance overrides found ?

Thanks for your help

Improve this question

1 Answer 1

Reset to default
4

You have to manually change ALL of the applications \ virtual folders to have only anonymous authentication. The thing is that changing authentication on the root level doesn't change anything on the virtual folders (applications) down the line, if the security on those is different from the root. So you should go and double check all of them.

Improve this answer
2
  • Makes sense. But if we have to do that for each application / virtual folder, why not just selecting all items in the Propertie dialog that appears after the change on the root level ?
    – Sébastien PRAT
    Commented Dec 13, 2013 at 16:11
  • 1
    If I remember correctly documentation states that all application and virtual folders should have anonymous access. It's up to you how you will do this, you might even do this through script
    – Andrey Marchuk
    Commented Dec 13, 2013 at 16:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.