How do I set up Core Service security?

Question

What is the best way to set up security for the core service? I'm using BasicHttpBinding at the moment and running the client project on my local PC, which does not have the Tridion CM.

I got the authentication to work by adding my ID to the server & Tridion CM as admin & then used those credentials when calling the core service API.

I can't do that in prod. So what is the best practice? What rights on server & tridion do I need to set up for the account I use when calling the Core Service? I'm a little confused as to what account needs what rights.

Thanks

Answer 1

As of Tridion 2013, the UI (both CME and XPM) actually use the core service as the communication method between the client application and the CM core - so this should partially answer your question.

The rights you need on the server depend on what you intend to do with your CoreService application. If you need to create & delete publications, then you need to be a Tridion Administrator. If you need to edit components on a given folder, then you need a user with Component Management in that publication's scope, and with WRITE permissions in that folder, etc.

The user you use to login with the Core Service will determine what actions can be performed.