REST-API with ADS user account as Authentication Module --> 401 Unauthorized

Like with any IIS hosted web application, you need to disable the Anonymous Authentication if you want to use Windows authentication. You cannot use both at the same time as anonymous overrules the windows authentication.

Thanks Markus for the hint. 

One more question - the search index for the WebPortal (ITShop) also runs on the AppServer - does the adjustment in IIS have any effects on the search index?

Sorry for answering late but as the SearchIndex is hosted on the AppServer, all calls against the SearchIndex require the correct access permission as configured by the Windows Authentication settings in your web.config of the Application Server.

No problem, Markus.

In the meantime we've tried a new server and managed to do it.

The configuration with SSL works. And the search index also seems to be built correctly, what the lines tell me

INFO (Indexing ) : Index is incomplete (100%); indexing will continue in 3000 ms

Take the opportunity to ask some more questions:
- is there a limit to the number of app servers with search indexes?
- Lines like this keep appearing in the log

INFO (AppServer ) : Could not find authentication data for session 2C72CXU2KtSQCpPAl397, it may have expired

what do they mean?

identitymanager-support said:

is there a limit to the number of app servers with search indexes?

No there is no limit. By default, every application server you are installing contains a search indexer. But you should have in mind, that every indexer put some additional load (a small one) onto the database.

The error message could be caused by connection attempts using a session cookie, where the session has already expired.