Tridion core service giving 403 - Forbidden: Access is denied

Question

Tridion core service i.e "https://xxxxxx.xxx/webservices/CoreService2011.svc) gives following error when I hit it in browser

"403 - Forbidden: Access is denied. You do not have permission to view this directory or page using the credentials that you supplied".

My tridion url uses SSO authentication and I am able to access the SDL Tridion portal and I have admin access.

Here is my web.config file.

<configuration>
  <tridionConfigSections>
    <sections>
      <clear />
      <add filePath="..\config\Tridion.ContentManager.config" />
    </sections>
  </tridionConfigSections>
  <system.web>
    <compilation debug="true" />
    <httpModules>
    </httpModules>
    <identity impersonate="false" />
    <authentication mode="Windows" />
  </system.web>
  <system.webServer>
    <validation validateIntegratedModeConfiguration="false" />
    <modules>
    </modules>
    <handlers>
      <remove name="svc-Integrated" />
    </handlers>
    <directoryBrowse enabled="true" />
  </system.webServer>
  <system.diagnostics>
    <sources>
    </sources>
    <sharedListeners>
      <add name="svclog" type="System.Diagnostics.XmlWriterTraceListener" initializeData="C:\Temp\CoreService\IISHost.svclog" />
    </sharedListeners>
    <trace autoflush="true" />
  </system.diagnostics>
  <system.serviceModel>
    <serviceHostingEnvironment aspNetCompatibilityEnabled="true" />
    <diagnostics>
      <messageLogging logEntireMessage="true" logMessagesAtServiceLevel="true" logMessagesAtTransportLevel="false" maxMessagesToLog="1000" />
    </diagnostics>
    <bindings>
      <basicHttpBinding>
        <binding name="CoreService_basicHttpBinding" maxReceivedMessageSize="10485760">
          <readerQuotas maxStringContentLength="10485760" maxArrayLength="10485760" />
          <security mode="TransportCredentialOnly">
            <transport clientCredentialType="None" />
          </security>
        </binding>
        <binding name="StreamDownload_basicHttpBinding" maxReceivedMessageSize="209715200" transferMode="StreamedResponse" messageEncoding="Mtom" sendTimeout="00:10:00">
          <security mode="TransportCredentialOnly">
            <transport clientCredentialType="None" />
          </security>
        </binding>
        <binding name="StreamUpload_basicHttpBinding" maxReceivedMessageSize="209715200" transferMode="StreamedRequest" messageEncoding="Mtom" receiveTimeout="00:10:00">
          <security mode="None" />
        </binding>
      </basicHttpBinding>
      <wsHttpBinding>
        <binding name="CoreService_wsHttpBinding" transactionFlow="true" maxReceivedMessageSize="10485760">
          <readerQuotas maxStringContentLength="10485760" maxArrayLength="10485760" />
          <security mode="TransportCredentialOnly">
            <message clientCredentialType="None" />
          </security>
        </binding>
      </wsHttpBinding>
    </bindings>
    <services>
      <service behaviorConfiguration="Tridion.ContentManager.ServiceHost.IISHost.CoreServiceBehavior" name="Tridion.ContentManager.ServiceHost.IISHost.CoreService2010">
        <endpoint address="basicHttp_2010" binding="basicHttpBinding" bindingConfiguration="CoreService_basicHttpBinding" name="basicHttp_2010" bindingNamespace="http://www.sdltridion.com/ContentManager/CoreService/2010" contract="Tridion.ContentManager.CoreService.ICoreService2010" />
        <endpoint address="streamDownload_basicHttp_2010" binding="basicHttpBinding" bindingConfiguration="StreamDownload_basicHttpBinding" name="streamDownload_basicHttp_2010" bindingNamespace="http://www.sdltridion.com/ContentManager/CoreService/2010" contract="Tridion.ContentManager.CoreService.IStreamDownload2010" />
        <endpoint address="streamUpload_basicHttp_2010" binding="basicHttpBinding" bindingConfiguration="StreamUpload_basicHttpBinding" name="streamUpload_basicHttp_2010" bindingNamespace="http://www.sdltridion.com/ContentManager/CoreService/2010" contract="Tridion.ContentManager.CoreService.IStreamUpload2010" />
        <endpoint address="wsHttp_2010" binding="wsHttpBinding" bindingConfiguration="CoreService_wsHttpBinding" name="wsHttp_2010" bindingNamespace="http://www.sdltridion.com/ContentManager/CoreService/2010" contract="Tridion.ContentManager.CoreService.ISessionAwareCoreService2010">
          <identity>
            <dns value="localhost" />
          </identity>
        </endpoint>
        <endpoint address="mex" binding="mexHttpBinding" name="mex" contract="IMetadataExchange" />
      </service>
      <service behaviorConfiguration="Tridion.ContentManager.ServiceHost.IISHost.CoreServiceBehavior" name="Tridion.ContentManager.ServiceHost.IISHost.CoreService2011">
        <endpoint address="basicHttp" binding="basicHttpBinding" bindingConfiguration="CoreService_basicHttpBinding" name="basicHttp" bindingNamespace="http://www.sdltridion.com/ContentManager/CoreService/2011" contract="Tridion.ContentManager.CoreService.ICoreService2011" />
        <endpoint address="streamDownload_basicHttp" binding="basicHttpBinding" bindingConfiguration="StreamDownload_basicHttpBinding" name="streamDownload_basicHttp" bindingNamespace="http://www.sdltridion.com/ContentManager/CoreService/2011" contract="Tridion.ContentManager.CoreService.IStreamDownload2011" />
        <endpoint address="streamUpload_basicHttp" binding="basicHttpBinding" bindingConfiguration="StreamUpload_basicHttpBinding" name="streamUpload_basicHttp" bindingNamespace="http://www.sdltridion.com/ContentManager/CoreService/2011" contract="Tridion.ContentManager.CoreService.IStreamUpload2011" />
        <endpoint address="wsHttp" binding="wsHttpBinding" bindingConfiguration="CoreService_wsHttpBinding" name="wsHttp" bindingNamespace="http://www.sdltridion.com/ContentManager/CoreService/2011" contract="Tridion.ContentManager.CoreService.ISessionAwareCoreService2011">
          <identity>
            <dns value="localhost" />
          </identity>
        </endpoint>
        <endpoint address="mex" binding="mexHttpBinding" name="mex" contract="IMetadataExchange" />
      </service>
    </services>
    <behaviors>
      <serviceBehaviors>
        <behavior name="Tridion.ContentManager.ServiceHost.IISHost.CoreServiceBehavior">
          <dataContractSerializer maxItemsInObjectGraph="2147483647" />
          <serviceMetadata httpGetEnabled="true" />
          <serviceAuthorization>
            <authorizationPolicies>
              <add policyType="Tridion.Security.IdentityModel.ClaimsPrincipalAuthorizationPolicy, Tridion.Security, Version=3.0.0.211, Culture=neutral, PublicKeyToken=ddfc895746e5ee6b" />
            </authorizationPolicies>
          </serviceAuthorization>
        </behavior>
      </serviceBehaviors>
    </behaviors>
  </system.serviceModel>
</configuration>

Answer 1

If you wish to use the webservices endpoint (which is hosted in IIS), you would need to implement the authentication mechanism required by your SSO solution.

Unless this is a requirement, I'd suggest that you instead switch to using the netTcp binding which is hosted by the Tridion Core Service Host service. That one is set up to use Windows authentication by default.

Answer 2

I got this problem because I was using SSL certificate as my user authentication and it was not able to check the revocation. I figured this out using the under given link. There is a simple registry tweak which saved my lot of time. I hope someone will get some help from this. http://www.windowstechupdates.com/403-forbidden-access-is-denied-you-do-not-have-permission-to-view-this-directory-or-page-using-the-credentials-that-you-supplied/