3

We want to lock down a Sitecore install when hitting it from the web with Windows Authentication to avoid brute force style attacks and to add a second layer of security on the web interfaces. Particularly on the /login and /shell folders.

By simply turning Windows Authentication on for those folders and disabling Anonymous Authentication, we do seem to be able to get it working. However, we use the Hedgehog Sitecore Package Deployer as part of the deploy process. It appears to be breaking and causing unexpected behaviour as a result of the security changes, which is indicative of a greater permissions issue, meaning that clearly there is more setup we need to do to allow backend tasks / processes to run properly.

We are currently working on implementing the following solutions:

However, a more concise answer for how to properly tackle this in Sitecore 8.2 would be appreciated. Cheers.

Improve this question
2
  • 1
    teamdevelopmentforsitecore.com/Blog/… did you check this link?
    – Vlad Iobagiu
    May 9, 2017 at 14:59
  • Are you running a single CM/CD server? If they are separate, is your CM server accessible to anyone? Did you consider locking down the CM server to internal users only?
    – jammykam
    May 10, 2017 at 11:20

1 Answer 1

Reset to default
1

To set up authentication through a local build follow these steps:

  1. Open the config file. The location and name of this file depends on the version of Visual Studio you are using. You will have to choose the correct file for each version of Visual Studio. The location and name for VS2012 is: C:\Program Files (x86)\Hedgehog Development\Team Development for Sitecore (VS2012)\HedgehogDevelopment.SitecoreProject.VSIP2012.dll.config

  2. Locate the binding:

  3. Under TdsServiceSoap change:

    1. security mode=”None” to security mode=”TransportCredentialOnly”
    2. transport clientCredentialType="None" proxyCredentialType="None" realm="" to transport clientCredentialType="Windows"

  4. Restart your IDE and test getting items from Sitecore.

More informations you can find here: https://www.teamdevelopmentforsitecore.com/Blog/setting-authenticated-access-tds

Improve this answer
2
  • Thank you. I need some time to digest this, but to be clear we are running into these issues on a server where Sitecore has already been deployed -- so it's upstream from where the local build is happening. TDS works fine in our local development environment (we are not using authentication there).
    – Marcel Gruber
    May 9, 2017 at 15:20
  • Please open the link and you will see how is working through a Build Server or MSBuild
    – Vlad Iobagiu
    May 9, 2017 at 15:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.