What is the best way to set up security for the core service? I'm using BasicHttpBinding at the moment and running the client project on my local PC, which does not have the Tridion CM.

I got the authentication to work by adding my ID to the server & Tridion CM as admin & then used those credentials when calling the core service API.

I can't do that in prod. So what is the best practice? What rights on server & tridion do I need to set up for the account I use when calling the Core Service? I'm a little confused as to what account needs what rights.


1 Answer 1


As of Tridion 2013, the UI (both CME and XPM) actually use the core service as the communication method between the client application and the CM core - so this should partially answer your question.

The rights you need on the server depend on what you intend to do with your CoreService application. If you need to create & delete publications, then you need to be a Tridion Administrator. If you need to edit components on a given folder, then you need a user with Component Management in that publication's scope, and with WRITE permissions in that folder, etc.

The user you use to login with the Core Service will determine what actions can be performed.

  • My utility is reading data only, so I don't need to be admin on Tridion. The core service call fails though when I use an account that has Tridion access but no access to the server. What role does the user need on the server?
    – Mr Smith
    Mar 28, 2014 at 19:54
  • 2
    Good point - Tridion doesn't authenticate your users, it's the OS or IIS that provides that part. At the very least, it must be an "Authorized User" on the windows machine, I doubt it needs more.
    – Nuno Linhares
    Mar 30, 2014 at 1:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.