I'm attempting to configure Content Manager to authenticate against an OpenLDAP backend. I believe I've followed the docs on configuring LDAP.
When I try to connect I get prompted to authenticate. This appears to succeed, but then I get an error:
Unable to Initialize TDSE object. Access is denied for the user DOMAIN1\USER1.
Error Code: 0x80040302 (-2147220734)
Call stack: Tridion.ContentManager.Security.AuthorizationManager.LoadAccessToken(String,IEnumerable`1,IEnumerable`1) Tridion.ContentManager.Security.AuthorizationManager.LoadAccessToken(IEnumerable`1) Tridion.ContentManager.Security.AuthorizationManager.LoadAccessToken(String,String) Tridion.ContentManager.Session..ctor(String,String,UserContext) Tridion.ContentManager.BLFacade.SystemFacade.InitializeUserContext(UserContext,String,String) UtilitiesTDS.GetUserContext TDSE.Initialize
Tailling the OpenLDAP logs show Content Manager is able to connect and search the directory. The user DOMAIN1\USER1 is in the TRUSTEES table.
I suspect the problem is with my configuration of the LDAP impersonation user. According to the docs:
LDAP uses an LDAP impersonation user to impersonate a user in an LDAP directory.
For LDAP authentication, create an impersonation user of type Directory Service and point to the Directory Service used by the Content Manager. The impersonation user name should match the credentials used by the Content Manager SDL Tridion 2011 Application Pool. If this is Network Service, then the impersonation user is NT AUTHORITY\NETWORK SERVICE
My app pool is running as NETWORK SERVICE, does this mean I need to add an impersonation user of type 'directory' for the user NT AUTHORITY\NETWORK SERVICE?
I haven't found much detail on this, can anyone tell me how the LDAP impersonation user is used?