topic Re: sts=Disallow via passthru in Alfresco Archive

sts=Disallow via passthru

bhowo — Tue, 19 Aug 2008 12:02:21 GMT

Hi,I have a problem using CIFS with Alfresco-Labs-3a.1032-Full-Setup.I have two Windows Server 2003: one is a Primary Directory Controller(PDC) and the other is my Alfresco-Testserver (ALF). NTLM-Configuration is done and working: No problem to upload or list the files of a domain user with the Webf

Re: sts=Disallow via passthru

alexist — Wed, 03 Sep 2008 08:00:49 GMT

I ve the same problem on linux server with version 3.0 1032

Re: sts=Disallow via passthru

houlnx — Sun, 28 Sep 2008 22:34:47 GMT

getting same error here. Using Labs 3b.

Re: sts=Disallow via passthru

infodon — Tue, 30 Sep 2008 14:46:03 GMT

Same issue with 3.0B.

Cannot authenticate via CIFS, but NTLM Auth works for website, but I must enter the full path to the login form. Typing http://localhost:8080/alfresco doesn't work. I have to enter http://localhost:8080/alfresco/faces/jsp/login.jsp then I can login to the website via NTLM.

CIFS results in error Null CIFS logon allowed, No Passthru details for WSNB1.

This configuration used to work in the earlier revisions 2.8

Re: sts=Disallow via passthru

aususer — Wed, 03 Dec 2008 03:48:55 GMT

Confirm same problem on 3.0C. (tried also on 3.0b with same results)..
Iv'e never had CIFS work properly under passthru.. (works fine using non-passthru)

I read that there was a (possible) "known bug(?)" in one of the code rev. for 3.0b..
ref: http://nene.snix.com/wiki/index.php/Alfresco

I wonder if this change has not been pushed down? Can't confirm where/if this is on the 3.0c..

Re: sts=Disallow via passthru

aususer — Wed, 03 Dec 2008 05:18:58 GMT

Just to clarify the problem - as it seems a few people are suffering this (has anyone actually got CIFS passthrough working??!!)
I am running on Centos 5.2 with jdk1.6.0_10

Symptom:
NTLM passthru configured and working for webfront end (client: XP/IE7- works fine.)
NTLM CIFS - XP SP3/windows users getting prompted for their username/password but not getting accepted.

Observation (well - what I am seeing - at least under Linux config - brandnew clean install of 3.0b and 3.0c)
1. Increase the smb logging to debug in /opt/Alfresco/tomcat/webapps/alfresco/WEB-INF/classes/log4j.properties
2. tail -f /opt/Alfresco/tomcat/logs/catalina.out
.. note: <username> changed for security reasons.
10:16:04,189 DEBUG [smb.protocol.auth] Authenticated user <username> sts=Disallow via Passthru
10:16:04,227 DEBUG [smb.protocol.auth] Authenticated user <username> sts=Disallow via Passthru
10:16:04,390 DEBUG [smb.protocol.auth] Authenticated user <username> sts=Disallow via Passthru
10:16:04,634 DEBUG [smb.protocol.auth] Authenticated user <username> sts=Disallow via Passthru
10:16:04,663 DEBUG [smb.protocol.auth] Authenticated user <username> sts=Disallow via Passthru
10:17:51,140 DEBUG [smb.protocol.auth] Authenticated user <username> sts=Disallow via Passthru..

Configs (from clean) are:
1. modify /opt/Alfresco/tomcat/webapps/alfresco/WEB-INF/classes/alfresco/authority-services-context.xml
and add an administrator user to the list.. (search for "adminUser" and add a domain user)
2. modify /opt/Alfrescotomcat/webapps/alfresco/WEB-INF/web.xml
configure/remove all unnecessary comments regarding and remove unnecessary filter entries as dictated by wiki(s)
3. /opt/Alfresco/tomcat/webapps/alfresco/WEB-INF/classes/alfresco/file-servers.xml
uncomment wins and change; change "authentication" from enterprise to "alfresco"; and "domain mappings"
4. /opt/Alfresco/tomcat/webapps/alfresco/WEB-INF/classes/alfresco/file-servers.properties
chnage links to enforce CIFS setup (note: broadcast changed from 255.255.255.255 to 192.168.100.255 to reflect network)5
5. rename /opt/Alfresco/tomcat/shared/classes/alfresco/extension/ntlm-authentication-context.xml(.sample)
set "localServers" portion to false
add   <property name="servers">
        <value><mydomain>\<myDCname></value>
        </property>
6. /opt/Alfresco/tomcat/shared/classes/alfresco/extension/file-servers-custom.xml
add (after line : <alfresco-config area="file-servers"> at the top of page)
<config evaluator="string-compare" condition="CIFS Server">
    <serverEnable enabled="true" />
    <host name="192.168.100.35" domain="<mydomainname>" />
    <comment>Alfresco CIFS Server</comment>
    <!– Set to the broadcast mask for the subnet –>
    <broadcast>192.168.100.255</broadcast>
    <sessionDebug flags="Negotiate,Socket" />
</config>
add to the very bottom of the page (ie. just betfore </alfresco-config>)
<config evaluator="string-compare" condition="Filesystem Security" replace="true">
    <authenticator type="alfresco" />
</config>
7. modify /opt/Alfresco/alfresco.sh
fix paths to both Alfresco home and Java home..

This is all as per the wikis I can find…

Re: sts=Disallow via passthru

rxm307 — Wed, 03 Dec 2008 22:00:13 GMT

so this is a working config?

Re: sts=Disallow via passthru

aususer — Wed, 03 Dec 2008 23:00:13 GMT

Nope… as stated, its my config of a "non-working" (ie NO CIFS functionality) setup for clarification of the problem.
same config on both 3c and 3b - with same fault.

I am yet to find/hear from anyone who actually has 3a, 3b or 3c working CIFS (happy to be proven wrong if someone can send me their config so I can get mine working before I dump this - I am about to try it under XP and see if that changes the problem)

There are plenty who can get the SSO on the webpage working (mine above does) - its just the CIFS that doesn't work.
Maybe I am just missing a step?
Anyone got a working config?

I am guessing that this probably all works fine if I paid for the "enterprise" version, but I was hoping to show the bosses it running before I asked for a cash cough-up.

Re: sts=Disallow via passthru

aususer — Thu, 04 Dec 2008 03:48:11 GMT

I can confirm, this is a problem specific to Labs 3b/c.
As I (incorrectly) listed in this post: http://forums.alfresco.com/en/viewtopic.php?f=9&t=15552

I installed a trial of enterprise 3.0 - and set it up exactly the same as labs 3b/c and it worked first time perfectly!

Developers?

Re: sts=Disallow via passthru

m4rco- — Fri, 05 Dec 2008 12:16:45 GMT

i've the same problem, but with kerberos authentication….
http://forums.alfresco.com/en/viewtopic.php?f=9&t=15679

Re: sts=Disallow via passthru

callermd — Sun, 07 Dec 2008 21:30:50 GMT

Unbelievable. This bug was known about in 3b and is still not fixed in 3c. Alfresco needs to take a long look at its quality control process. This makes CIFS unusable for anyone with a non-trivial userbase.

Re: sts=Disallow via passthru

meansartin14 — Tue, 06 Jan 2009 15:26:26 GMT

Unbelievable. This bug was known about in 3b and is still not fixed in 3c. Alfresco needs to take a long look at its quality control process. This makes CIFS unusable for anyone with a non-trivial userbase.

I am also having this issue. I would be sincerely interested in the solution.

Re: sts=Disallow via passthru

meansartin14 — Tue, 13 Jan 2009 20:40:32 GMT

I have started a thread that I hope to eventually turn into a AlfrescoWiki page for how to configure Active Directory authentication for both CIFS and the Web Interface in Alfresco Labs 3c.

Please see my thread:
[ERROR]Alfresco Engineers: CIFS auth does not work. Sugg?

Please come join in the discussion, or at least subscribe to the thread. I want to try to get everyone having these types of issues into the thread so that we can get a large collection of experiences and configurations.

We WILL find the answer for how to enable Active Directory authentication with CIFS in Alfresco!!

Re: sts=Disallow via passthru

aliciac — Wed, 28 Jan 2009 03:14:45 GMT

I had this problem with Vista clients trying to access Alfresco CIFS.
So i tried the following:
- On the start menu in the search field type "gpedit.msc", hit enter. This will open the group policy editor.
- Go to "Computer Configruation" –>"Windows Settings" –>"Security Settings" –>"Local Policies" –>"Security Options"
- In the pane on the right side of the screen, select "Network Security: LAN Manager Authentication level." By default this read "Send NTLMv2 response only."
- Change "Send NTLMv2 respone only" to "Send LM & NTLM – use NTLMv2 session security if negotiated"

And now i can access the Alfresco share. Hope this helps

Re: sts=Disallow via passthru

rxm307 — Wed, 28 Jan 2009 03:42:01 GMT

I tried this in Windows XP SP3 but that setting was already set.