2

We want to lock down a Sitecore install when hitting it from the web with Windows Authentication to avoid brute force style attacks and to add a second layer of security on the web interfaces. Particularly on the /login and /shell folders.

By simply turning Windows Authentication on for those folders and disabling Anonymous Authentication, we do seem to be able to get it working. However, we use the Hedgehog Sitecore Package Deployer as part of the deploy process. It appears to be breaking and causing unexpected behaviour as a result of the security changes, which is indicative of a greater permissions issue, meaning that clearly there is more setup we need to do to allow backend tasks / processes to run properly.

We are currently working on implementing the following solutions:

However, a more concise answer for how to properly tackle this in Sitecore 8.2 would be appreciated. Cheers.

  • 1
    teamdevelopmentforsitecore.com/Blog/… did you check this link? – Vlad Iobagiu May 9 '17 at 14:59
  • Are you running a single CM/CD server? If they are separate, is your CM server accessible to anyone? Did you consider locking down the CM server to internal users only? – jammykam May 10 '17 at 11:20
1

To set up authentication through a local build follow these steps:

  1. Open the config file. The location and name of this file depends on the version of Visual Studio you are using. You will have to choose the correct file for each version of Visual Studio. The location and name for VS2012 is: C:\Program Files (x86)\Hedgehog Development\Team Development for Sitecore (VS2012)\HedgehogDevelopment.SitecoreProject.VSIP2012.dll.config

  2. Locate the binding:

  3. Under TdsServiceSoap change:

    1. security mode=”None” to security mode=”TransportCredentialOnly”
    2. transport clientCredentialType="None" proxyCredentialType="None" realm="" to transport clientCredentialType="Windows"
  4. Restart your IDE and test getting items from Sitecore.

More informations you can find here: https://www.teamdevelopmentforsitecore.com/Blog/setting-authenticated-access-tds

  • Thank you. I need some time to digest this, but to be clear we are running into these issues on a server where Sitecore has already been deployed -- so it's upstream from where the local build is happening. TDS works fine in our local development environment (we are not using authentication there). – Marcel May 9 '17 at 15:20
  • Please open the link and you will see how is working through a Build Server or MSBuild – Vlad Iobagiu May 9 '17 at 15:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.