We are using SSO with siteminder to login to Tridion CMS. When ever a user tries to login the siteminder agent redirects him to login page. On providing credentials, they are validated by a policy server and on successful validation the user is redirected to cms dashboard. The issue is that even if the user exist in policy server but do not exist in Tridion CMS, he is able to log in to CMS. But in user name it displays NT AUTHORITY\IUSR where as I am not using impersonation anywhere (earlier this user was in impersonation but removed later). Is there any service which I forgot to restart after removing the impersonation user(Though I have restarted com+ and iisreset).

Whenever anonymous authentication is enabled IIS takes NT Authority\IUSR as logged in user. Also in web.config we comment the lines when configuring SSO. I am not able to understand when does the CMS deny user when implemented with SSO. In my case the user exist in SSO policy server but do not exist in CMS.

  • what version of SDL Tridion are you using? And did you also restart the Tridion services (or tried rebooting the whole machine)? Commented May 19, 2014 at 12:41
  • TridionServiceHost should be restarted as well Commented May 19, 2014 at 12:49
  • I have rebooted the whole machine but still its taking NT AUTHORITY\IUSR as impersonate user Commented May 20, 2014 at 4:43

2 Answers 2


I hope you are following the steps properly from SSO configuration documentation (login required)


At last got solution from one of my colleague. The SsoAgentHttpModule should be the last module in request pipeline. After changing the order of Siteminder httpmodule and SsoAgentHttpmodule the application start working fine. Earlier the request was being processed by SSOagenthttpmodule before the CA siteminder module.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.