Hot answers tagged

7

Tridion will make sure the person is authenticated from the AD, but that's it. Tridion as an organization has a best-of-breed approach and tries not to do things that others have done well, including authorization solutions. They sit on top and integrate with other well defined and correct solutions. I would suggest to place a page on your extranet login ...


5

Check the following logs to see what's happening: The Tridion Event Log The Windows security log Any IIS logging ( event log and the website logging ) If nothing is logged, use an LDAP sniffer or Fiddler to see what's happening.


5

At this point, Tridion provides SSO option via HTTP Headers from an authenticated proxy in front of Tridion GUI. SAML assertions/IDP for Tridion GUI is not supported yet, AFAIK.


4

The MTSUser must be a windows account, as this account will interact with the OS quite often. During installation, the Administrator account must be a Windows account too, as you will not be able to login to Tridion with an LDAP user immediately after installing the server (there's some additional configuration steps to follow). So, in short - both should ...


4

The impersonation user does not have to be added to the TRUSTEES table, but rather in the SDL Tridion Configuration MMC Snap In. That's way easier anyway. ;) You can read about this in the manual and here as well. (login required) The short version is: Start the SDL Tridion MMC Snap-in by selecting Programs > SDL Tridion > SDL Tridion Content Manager ...


3

First of all, you will have to change both server-side and client-side WCF configuration, so Message based security based on username/password is used instead of Windows authentication. Secondly, you will have to provide the username/password in code in a different way than you have in your example: factory.Credentials.Windows.ClientCredential = ...


3

The error message "unable to bind with admin user" means there is a problem with the Search account credentials as defined in the LDAP ISAPI filter configuration.


3

I would guess it's the SDL Monitoring Service whichs sends HTTP requests on a configurable interval to determine if your CM Website is still up-and-running. It has probably not been configured with the right credentials, resulting in the authentication failure in the event log. If you check the status of the SDL Monitoring Service, it will probably indicate ...


3

I would suspect they are in the SDL Tridion Content Manager 'Snap-In' / SDL Tridion event log on the CM machine. Have you tried looking in there?


2

Looking at the API, there's no obvious way to just ask TOM.NET for a list. However, from a group you can get its claim mappings, which in this case will be instances of DirectoryGroupMapping. From the various properties of this class, you can construct an ADSI correct query, and then use System.DirectoryServices to execute it and retrieve the results. ...


2

Since 2013 SP1 Content Porter Core part is placed in Tridion Core (TcmServiceHost + IIS). Your stack trace shows, that there is problem on creating session (impersonation). Look here http://sdllivecontent.sdl.com/LiveContent/content/en-US/SDL%20Tridion%20full%20documentation-v1/GUID-20723F2E-686D-44AC-835A-8F84A5DD7A22#url=/LiveContent/web/search.xql%3Fc%3Dt%...


2

Did you configure the steps needed for Content Porter configuration with LDAP? Please check the Tridion docs and follow these steps : http://sdllivecontent.sdl.com/LiveContent/content/en-US/SDL%20Content%20Porter%20full%20documentation-v1/GUID-3AB5898C-743B-4B4B-BE8B-46F1C0CDD300 Please note, these are additional steps needed for Content Porter in addition ...


2

Assuming that your impersonation user is set up correctly, the most important authentication that takes place is the bind to the LDAP server. Correspondingly, the most important logs to look in are those of the LDAP server itself. Where these are to be found depends on which LDAP server you are using, but it shouldn't be too hard to find out where they are. ...


2

The configuration of the authentication method on the server-side is done in two Web.config files (one for the CM Website root and one for the webservices web app). These config files contain XML comments about what to change for LDAP auth and HTTPS. You can also have a peek at SetupLDAP.ps1 itself. It will at least show which config setting are changed. ...


2

By default, the cms-import.ps1 script uses Windows authentication and uses the current Windows user to log in to the CMS. For LDAP authentication, you should specify -cmsAuth Basic and specify the CMS user name and password as -cmsUserName and -cmsUserPassword parameters, respectively. UPDATE: I see you already specified that. However, the error message ...


2

It seems that the credentials that you are using to connect to the LDAP server are no longer valid; maybe the password expired or someone changed the password policy on the domain level. I'd double-check your Directory Service configuration settings (e.g. "search account password") as well as the MTSUser account to make sure they are up-to-date and working.


2

Online docs would appear to be your friend :) Configuring WebDAV Connector for LDAP authentication or single sign-on No specific steps are needed to make use LDAP or SSO authentication work if you use WebDAV (if both are properly set up, as documented), as long as you ensure that your IIS authentication settings in the webdav/ folder are the same ...


1

Sample code for without config to call coreservice: static ISessionAwareCoreService GetCoreSeriviceClient(string hostname, string username, string password) { var binding = new NetTcpBinding { MaxBufferSize = int.MaxValue, MaxBufferPoolSize = int.MaxValue, MaxReceivedMessageSize ...


1

Basing my answer on your comment: -cmsAuth -cmsUsername and -cmsUserPassword was specified. Have reinstalled Web 8 now not using HTTPS and worked around it by setting up SSO and AD using the same Directory service name as the domain itself. Although there are still some issues with Core service but will look in to that further, managed to work around the ...


1

The stack trace suggests there is a problem with connecting to the LDAP server. In particular, the LDAP authentication module is trying to do a so-called "Fast Concurrent Bind" on the LDAP server which fails with "The server cannot handle LDAP requests". Fast Concurrent Bind is a feature implemented by Active Directory. The LDAP auth module uses that ...


1

maybe you have to grant rwx to IUSR on ImportExportService virual folder. IUSR is the default user for anonymous login on IIS. Hope this helps!


1

If you mean setting in MMC than there can only be one entity. But the good thing is that this is used only for showing list of users when adding a new user, it doesn't affect users which are already in the tridion database, it also doesn't affect users which are added via group sync.


1

We had faced the same issue and like you we had also verified most of the things and they were all in place. Then we raised it with the SDL Tridion Support and after extensive WebEx session with the Support span over days, we figured out the issue was with the LDAP Directory Configuration. I am not sure if it is going to be the same issue with you (LDAP ...


Only top voted, non community-wiki answers of a minimum length are eligible