topic CIFS conf problem (KrbException: Identifier doesn't match... in Alfresco Archive

CIFS conf problem (KrbException: Identifier doesn't match...

nyugi — Sun, 21 Sep 2008 23:18:50 GMT

Hi everyone!I have a little but very annoying problem with configuring CIFS on Alfresco Labs.About the environment:I have one computer to test this function with Windows XP on it (Computer name: va; Domain: mydom). I've decided to create a virtual PC and to install a Windows 2003 Server on it. This

Re: CIFS conf problem (KrbException: Identifier doesn't match...

nyugi — Mon, 22 Sep 2008 21:58:31 GMT

Hi!

It's me again. I made a step forward. The writers of the wiki page Configuring the CIFS and web servers for Kerberos/AD integration presumed that every reader is aware of the fact, that the <realm> is the uppercase name of the Windows domain by the ktpass utility. (See: Step-by-Step Guide to Kerberos 5 (krb5 1.0) Interoperability) I wasn't.
I replaced all occurences of ALFTEST.NYUGI (my fictitious realm name) with my server's domain TEST2003.NYUGI. This resulted a clean, exceptionless Alfresco Server start.

But the Alfresco Web Client is not available. Firefox shows an empty page (even the source is empty), IE shows an Alfresco System Error page:
[size=85]


java.lang.ArrayIndexOutOfBoundsException: End of data buffer 
at org.alfresco.jlan.server.auth.asn.DERBuffer.unpackBytes(DERBuffer.java:195) 
at org.alfresco.jlan.server.auth.asn.DERApplicationSpecific.derDecode(DERApplicationSpecific.java:95) 
at org.alfresco.jlan.server.auth.asn.DERBuffer.unpackObject(DERBuffer.java:369) 
at org.alfresco.jlan.server.auth.asn.DERBuffer.unpackApplicationSpecific(DERBuffer.java:759) 
at org.alfresco.jlan.server.auth.spnego.NegTokenInit.decode(NegTokenInit.java:191) 
at org.alfresco.web.app.servlet.KerberosAuthenticationFilter.doFilter(KerberosAuthenticationFilter.java:581) 
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:215) 
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:188) 
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:210) 
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:174) 
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127) 
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:117) 
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:108) 
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:151) 
at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:870) 
at org.apache.coyote.http11.Http11BaseProtocol$Http11ConnectionHandler.processConnection(Http11BaseProtocol.java:665) 
at org.apache.tomcat.util.net.PoolTcpEndpoint.processSocket(PoolTcpEndpoint.java:528) 
at org.apache.tomcat.util.net.LeaderFollowerWorkerThread.runIt(LeaderFollowerWorkerThread.java:81) 
at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:685) 
at java.lang.Thread.run(Thread.java:595) 
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

[/size]
The strange thing is, no exceptions appeared in the logs (except the java.lang.ArrayIndexOutOfBoundsException).
I hope I'll find something if I search the forums.

Re: CIFS conf problem (KrbException: Identifier doesn't match...

jitse — Wed, 24 Sep 2008 08:14:11 GMT

The blank screen in firefox is probably a 401 header without content.
We experienced the same problem, you have to configure firefox with the about:config value of [network.negotiate-auth.trusted-uris]. We added the servername of alfresco here.
Can you show the server log when starting?

Re: CIFS conf problem (KrbException: Identifier doesn't match...

nyugi — Thu, 25 Sep 2008 21:53:42 GMT

Hi jitse!

Thanks for the FF conf tip. I'll try it as soon as I can.

However I think I realized, that without understanding the very basics of several related technologies, I will not succeed in my task. So maybe it would be more effective to ask help for the exact problem. Thus here it is:
I have Windows clients in a domain. I have domain users in groups. The AD server is a Win 2003 Server. I am looking for a DMS solution which is handy enough to persuade every user to use it instead of a simple file server. For this the file operations copying from local to the server (upoad) and vice versa (download) should be accessible in file managers. That's why I thought of using CIFS. I never used it before, but according to the docs it is very promising. (I tried WebDAV with some other DMS's, but WebDAV is too slow for us.)
I addition to the simple file access I would like to be able to control permissions for the AD groups. So users of one AD group could edit stuff, users of other AD group could only read them, etc.

So this my real task is, and for this I need help. Something like an explained step by step AD integrated CIFS configuration guide for Dummies. I know it's too much, but there are too many things to go after.

… Okay, some well targeted links to some related readings would be appreciated also.

Re: CIFS conf problem (KrbException: Identifier doesn't match...

nyugi — Tue, 07 Oct 2008 20:08:01 GMT

Ok! I see. I asked too much.
Anyway I got to the next level. Now when I want to browse the CIFS server, the login name and password are asked. But nothing is accepted. The strange thing is, that there are no signs of these tries in any of the logs. I searched the alfresco's the tomcat's log, the client's (winXP) and the server's (win2003) event logs too, but nothing.
Are there any options to set for getting some debug logs?

Re: CIFS conf problem (KrbException: Identifier doesn't match...

ddenev — Sun, 12 Oct 2008 16:18:27 GMT

I can confirm the problem. I did exactly as in the wiki and got the same exception with Alfresco Labs 3 on Windows 2003 Server AD.

Re: CIFS conf problem (KrbException: Identifier doesn't match...

jitse — Mon, 13 Oct 2008 06:56:36 GMT

You can set the debuglevel in the log4j.properties (under /tomcat/webapps/alfresco/WEB-INF/classes, AND you can set the kerberos debugging in the CIFS-authenticator you added in the file-server-custom.xml
(<kerberosDebug/> It's a new addition at the end of the page of http://wiki.alfresco.com/wiki/Configuring_the_CIFS_and_web_servers_for_Kerberos/AD_integration

I guess it must have something to do with failing kerberos authentication for cifs.
My guess : If you are using SSO the user-passwords are stored different (other hash?). There will not be a match if alfresco authentication is tried on these accounts. We experienced something likewise, and found out that accounts we made in alfresco before turning on SSO (which can/will auto-create your users) were able to use SSO on the webclient and alfresco authentication (or ntlm) on CIFS.

You can check this by forcing kerberos-only authentication for CIFS, also a newly added feature, described at the end of aforementioned wiki page.

Maybe we get SSO/Kerberos with AD as KDC for CIFS working this week, if so i will provide some additional feedback.
We were struggling with the principals for CIFS, it seems alfresco uses the [cifs/short-host-name] principal, but if you follow the wiki you only ktpass the [cifs/FQDN-hostname] alfresco host.
It seemed that in our case the [cifs/short-host-name] principal] is not chained to the alfrescocifs UPN(user principal) because the ktpass not only provides a keytab but also does the linking of SPN to UPN.
Hope that helps

Cheers Jitse

Re: CIFS conf problem (KrbException: Identifier doesn't match...

ddenev — Tue, 14 Oct 2008 12:50:34 GMT

You can set the debuglevel in the log4j.properties (under /tomcat/webapps/alfresco/WEB-INF/classes, AND you can set the kerberos debugging in the CIFS-authenticator you added in the file-server-custom.xml
(<kerberosDebug/> It's a new addition at the end of the page of http://wiki.alfresco.com/wiki/Configuring_the_CIFS_and_web_servers_for_Kerberos/AD_integration

Where exactly in log4j.properties shall I set the debug level

I guess it must have something to do with failing kerberos authentication for cifs.
My guess : If you are using SSO the user-passwords are stored different (other hash?). There will not be a match if alfresco authentication is tried on these accounts. We experienced something likewise, and found out that accounts we made in alfresco before turning on SSO (which can/will auto-create your users) were able to use SSO on the webclient and alfresco authentication (or ntlm) on CIFS.

You can check this by forcing kerberos-only authentication for CIFS, also a newly added feature, described at the end of aforementioned wiki page.

I did this but nothing changed

Maybe we get SSO/Kerberos with AD as KDC for CIFS working this week, if so i will provide some additional feedback.
We were struggling with the principals for CIFS, it seems alfresco uses the [cifs/short-host-name] principal, but if you follow the wiki you only ktpass the [cifs/FQDN-hostname] alfresco host.
It seemed that in our case the [cifs/short-host-name] principal] is not chained to the alfrescocifs UPN(user principal) because the ktpass not only provides a keytab but also does the linking of SPN to UPN.
Hope that helps

Cheers Jitse

Actually for me it is quite vague what are you suggesting in order to fix the issue. Can you not post an updated manual for setting CIFS with Kerberos? It is obvious it doesn't work.

I tried with the latest Labs version (from 01.10.2008), followed the wiki to the letter and got the same exception again and again:

15:34:54,453 User:guest ERROR [[localhost].[/alfresco].[Faces Servlet]] Servlet.service() for servlet Faces Servlet threw exception java.lang.ArrayIndexOutOfBoundsException: End of data buffer
        at org.alfresco.jlan.server.auth.asn.DERBuffer.unpackBytes(DERBuffer.java:195)
        at org.alfresco.jlan.server.auth.asn.DERApplicationSpecific.derDecode(DERApplicationSpecific.java:95)
        at org.alfresco.jlan.server.auth.asn.DERBuffer.unpackObject(DERBuffer.java:369)
        at org.alfresco.jlan.server.auth.asn.DERBuffer.unpackApplicationSpecific(DERBuffer.java:759)
        at org.alfresco.jlan.server.auth.spnego.NegTokenInit.decode(NegTokenInit.java:191)
        at org.alfresco.web.app.servlet.KerberosAuthenticationFilter.doFilter(KerberosAuthenticationFilter.java:581)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:215)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:188)
        at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:210)
        at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:174)
        at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
        at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:117)
        at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:108)
        at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:151)
        at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:870)
        at org.apache.coyote.http11.Http11BaseProtocol$Http11ConnectionHandler.processConnection(Http11BaseProtocol.java:665)
        at org.apache.tomcat.util.net.PoolTcpEndpoint.processSocket(PoolTcpEndpoint.java:528)
        at org.apache.tomcat.util.net.LeaderFollowerWorkerThread.runIt(LeaderFollowerWorkerThread.java:81)
        at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:685)
        at java.lang.Thread.run(Thread.java:619)‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Please fix this. Thank you.

Re: CIFS conf problem (KrbException: Identifier doesn't match...

subemontes — Thu, 16 Oct 2008 09:34:01 GMT

Have u got any luck ? Have been figthing for 2 days now with no complete luck

Re: CIFS conf problem (KrbException: Identifier doesn't match...

ddenev — Thu, 16 Oct 2008 09:57:27 GMT

Not at all. I've been fighting with this issue for 2 weeks and gave up. Now I'm waiting for somebody from Alfresco to come in and to suggest a solution. Obviously they are not so eager to help. Which makes me draw conclusions about the product and the support.

Re: CIFS conf problem (KrbException: Identifier doesn't match...

kaklaman — Wed, 05 Nov 2008 14:46:46 GMT

Is there any news for this problem? I am receiving the same stacktrace when I try to login…

Re: CIFS conf problem (KrbException: Identifier doesn't match...

meansartin14 — Tue, 06 Jan 2009 17:34:08 GMT

Not at all. I've been fighting with this issue for 2 weeks and gave up. Now I'm waiting for somebody from Alfresco to come in and to suggest a solution. Obviously they are not so eager to help. Which makes me draw conclusions about the product and the support.

Has your issue been resolved? If so, how? What configurations were necessary?

Are you now able to login to the Alfresco Web Interface via single sign-on AND map a network drive to the Alfresco CIFS server?

Re: CIFS conf problem (KrbException: Identifier doesn't match...

jitse — Wed, 07 Jan 2009 06:54:07 GMT

Well, SSO/Kerberos is not a fairytale, it can work, and the supportguys/girls from alfresco where assistive enough though in the end it boils down to providing the right data.
We used Alf 2.2.1E, a win2k3 server with AD and a RHEL5 server with alfresco (not part of an AD domain), and XP domain-clients with FF and IE and windows explorer.
Actually followed the manual (the wiki page http://wiki.alfresco.com/wiki/Configuring_the_CIFS_and_web_servers_for_Kerberos/AD_integration) to the letter.
We ended up using the CIFS\principal (without domainname) in the file-server configuration file (the only difference to the wikipage).
We did use wireshark en kerberos utilities to figure out frequently were we where heading and what was working and what not, what kerberos handshakes were being made.
Depending on the type of networklease / static ip of the linuxserver , we also had issues using FQDN or short names, which of course influenced SSO/Kerberos working or not.

Re: CIFS conf problem (KrbException: Identifier doesn't match...

wuff — Tue, 13 Jan 2009 15:25:33 GMT

We ended up using the CIFS\principal (without domainname) in the file-server configuration file (the only difference to the wikipage).

Hi,

could you please post the config?
You're talking about the fiel file-servers.xml, the "Filesystem Security"-part, right?

Re: CIFS conf problem (KrbException: Identifier doesn't match...

meansartin14 — Tue, 13 Jan 2009 20:42:25 GMT

I have started a thread that I hope to eventually turn into a AlfrescoWiki page for how to configure Active Directory authentication for both CIFS and the Web Interface in Alfresco Labs 3c.

Please see my thread:
[ERROR]Alfresco Engineers: CIFS auth does not work. Sugg?

Please come join in the discussion, or at least subscribe to the thread. I want to try to get everyone having these types of issues into the thread so that we can get a large collection of experiences and configurations.

We WILL find the answer for how to enable Active Directory authentication with CIFS in Alfresco!!