As it was not possible to have a separate application use the SAML Authentication module (see Rick's answer) I had to take a step back and re-think how my custom pages work.
Because the custom pages are using the core service, what I really wanted was to make sure that core service calls were done in the context of the authenticated user of the Tridion UI. ...
IIRC, the current implementation for SAML 2.0 authentication uses ASP.NET Session State, which requires:
Use of Sticky Session on your Load Balancer (to prevent the same ASP.NET Session ending up on multiple CMS servers)
Use of a single Web Application
So, creating your own separate Web Application may not work. Can you create a Virtual Directory instead ...
Yes they do. That is: it is possible to let the client tools connect to the CM server through an SSO proxy. Prerequisite for such a configuration is that the SSO proxy uses HTTP basic auth for those endpoints
One could argue that is hardly a SSO experience, but that is as far as it goes currently.
There will be two step process:
When idle time goes beyond the limit that you specified, ...
You have to manually change ALL of the applications \ virtual folders to have only anonymous authentication. The thing is that changing authentication on the root level doesn't change anything on the virtual folders (applications) down the line, if the security on those is different from the root. So you should go and double check all of them.
To set up Content Porter to work with SSO in mixed mode you need to:
1) In IIS find "SDL Tridion" Web site, for ImportExportService application and ImportExportService/Client folder in Authentication settings set AnonymousAuthentication to Enabled (other Authentications should be Disabled)
2) In IIS find "SDL Tridion" Web site, for Webservices application ...
You could possibly do this via GUI extension, but note that a user doesn't always sees the dashboard when he or she logs in. If they use a url pointing to some structure group or folder, the user will bypass the dashboard, and immediately go to a specific view.
Also, the user can connect via Experience Manager or a core service client,... In some cases, your ...
The out-of-the-box SSO integration is intended for SSO systems that provide the user name in an HTTP header.
ADFS is not such a SSO system; it uses SAML to send a set of claims to the application.
So, the OOTB SSO integration cannot be used to integrate with ADFS. It should be possible to create an integration yourself, but that is far from trivial.
I would use a iis module for this. As the information you are trying to capture is not dependent on tridion and in this way you are not building any dependency on that module. You would be able to reuse that module in other application as well to get the same functionality.
The Tridion Sites OOTB Installed system UI to Search and add users will not work for SAML enabled system, because of DOMAIN ! = LDAP
if you use Domain users then they are windows users, and you might need to configure the services to use windows auth.
In order to search and add LDAP users for Content Porter, Templating, and core services.
The alternative way ...
Your error message indicates a 404 error, meaning the TTM services can't be found in IIS.
Can you verify that Topology Manager is correctly installed in your environment ?
Something else you might need to check is if in your server settings, Http Activation for WCF is configured correctly (see https://stackoverflow.com/a/32206669/1947899).
We did use OpenAm SSO setup for Content Manager authentication.
Excluded the core services and templates from OpenAM SSO authentication and enabled LDAP authentication it works.
<remove name="SsoAgentHttpModule" />
<remove name="OpenAmModule64" />...
At last got solution from one of my colleague. The SsoAgentHttpModule should be the last module in request pipeline. After changing the order of Siteminder httpmodule and SsoAgentHttpmodule the application start working fine. Earlier the request was being processed by SSOagenthttpmodule before the CA siteminder module.