1

We are using SSO with siteminder to login to Tridion CMS. When ever a user tries to login the siteminder agent redirects him to login page. On providing credentials, they are validated by a policy server and on successful validation the user is redirected to cms dashboard. The issue is that even if the user exist in policy server but do not exist in Tridion CMS, he is able to log in to CMS. But in user name it displays NT AUTHORITY\IUSR where as I am not using impersonation anywhere (earlier this user was in impersonation but removed later). Is there any service which I forgot to restart after removing the impersonation user(Though I have restarted com+ and iisreset).

Whenever anonymous authentication is enabled IIS takes NT Authority\IUSR as logged in user. Also in web.config we comment the lines when configuring SSO. I am not able to understand when does the CMS deny user when implemented with SSO. In my case the user exist in SSO policy server but do not exist in CMS.

  • what version of SDL Tridion are you using? And did you also restart the Tridion services (or tried rebooting the whole machine)? – Bart Koopman May 19 '14 at 12:41
  • TridionServiceHost should be restarted as well – Andrey Marchuk May 19 '14 at 12:49
  • I have rebooted the whole machine but still its taking NT AUTHORITY\IUSR as impersonate user – rdhaundiyal May 20 '14 at 4:43
1

I hope you are following the steps properly from SSO configuration documentation (login required)

1

At last got solution from one of my colleague. The SsoAgentHttpModule should be the last module in request pipeline. After changing the order of Siteminder httpmodule and SsoAgentHttpmodule the application start working fine. Earlier the request was being processed by SSOagenthttpmodule before the CA siteminder module.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.