topic Re: [ERROR]Alfresco Engineers: CIFS auth does not work. Sugg? in Alfresco Archive

[ERROR]Alfresco Engineers: CIFS auth does not work. Sugg?

meansartin14 — Tue, 13 Jan 2009 18:15:40 GMT

[size=125]Purpose:[/size]This thread is an attempt to resolve an issue that appears to plague many of us: CIFS server authentication configuration. Hopefully, this thread will come in handy to all of those who have posted about their various CIFS configurations not working. If possible, I would also

Re: [ERROR]Alfresco Engineers: CIFS auth does not work. Sugg?

meansartin14 — Tue, 13 Jan 2009 20:05:10 GMT

Scenario 2: Issue, Output, and Configuration - Active Directory NTLM Authentication CIFS Mapping Attempt:
This attempt builds off the previous post. In this post, I attempt to configure the Web Interface for Active Directory authentication and SSO, and configure the CIFS server to authenticate against Active Directory, both using NTLM passthru. Kerberos is also configured for the CIFS server authenticator. The following AlfrescoWiki pages were used as reference guides:
3.0 Configuring NTLM (NOTE: Only sections "Alfresco Explorer and WebDav SSO using NTLM" and "NTLM Passthru Authentication" were relevant)
CIFS Server Authentication
Enterprise Security and Authentication Configuration

This configuration attempt fails to allow "Map Network Drive" to the CIFS server. Though, the Alfresco Web Interface works flawlessly to allow Active Directory users SSO capability.

Output to alfresco.log (NOTE: log4j.logger.org.alfresco.web.app.servlet.NTLMAuthenticationFilter=debug and log4j.logger.org.alfresco.repo.webdav.auth.NTLMAuthenticationFilter=debug are ACTIVE)
"Map Network Drive" (Drive: Z: ; Folder: \\alfserver\alfresco), click Finish

14:48:34,624 DEBUG [org.alfresco.smb.protocol.auth] NT Session setup SPNEGO, MID=8, UID=0, PID=65279
14:48:34,628 DEBUG [org.alfresco.smb.protocol.auth] Kerberos AP-REQ - [AP-REQ:APOptions=MutualAuth ,Ticket=Len=985,Authenticator=EncType=23,Kvno=-1,Len=181]
14:48:34,630 DEBUG [org.alfresco.smb.protocol.auth] Kerberos mutual auth required, parsing AP-REQ
14:48:34,658 DEBUG [org.alfresco.smb.protocol.auth] Using OID MS Kerberos5 for NegTokenTarg
14:48:34,662 DEBUG [org.alfresco.smb.protocol.auth] Created NegTokenTarg using updated AP-REP, added subkey
14:48:34,662 DEBUG [org.alfresco.smb.protocol.auth] Machine account logon, <client PC name>$, as null logon
14:48:34,662 DEBUG [org.alfresco.smb.protocol.auth] Logged on using Kerberos, user <client PC name>$
14:48:34,663 DEBUG [org.alfresco.smb.protocol.auth] User  logged on  (type Null)
14:48:34,664 DEBUG [org.alfresco.smb.protocol.auth] Allocated UID=0 for VC=[0:0,[:null,Windows XP 3790 Service Pack 2,,<client pc IP>],Tree=0,Searches=0]
14:48:34,683 DEBUG [org.alfresco.smb.protocol.auth] NT Session setup SPNEGO, MID=24, UID=0, PID=65279
14:48:34,683 DEBUG [org.alfresco.smb.protocol.auth] Kerberos AP-REQ - [AP-REQ:APOptions=MutualAuth ,Ticket=Len=1020,Authenticator=EncType=23,Kvno=-1,Len=176]
14:48:34,683 DEBUG [org.alfresco.smb.protocol.auth] Kerberos mutual auth required, parsing AP-REQ
14:48:34,694 DEBUG [org.alfresco.smb.protocol.auth] Using OID MS Kerberos5 for NegTokenTarg
14:48:34,695 DEBUG [org.alfresco.smb.protocol.auth] Created NegTokenTarg using updated AP-REP, added subkey
14:48:34,698 DEBUG [org.alfresco.smb.protocol.auth] Logged on using Kerberos, user <user>
14:48:34,699 DEBUG [org.alfresco.smb.protocol.auth] User <user>@MY.REALM.COM logged on  (type Normal)
14:48:34,699 DEBUG [org.alfresco.smb.protocol.auth] Allocated UID=1 for VC=[1:1,[<user>@MY.REALM.COM:null,Windows XP 3790 Service Pack 2,,<client pc ip>],Tree=0,Searches=0]‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

"Map Network Drive" (Drive: Z: ; Folder: \\alfserver\alfresco), click "Connect using a different user name" (User name: Alfresco\<user>); Note that <user> is the same value entered when logging into the client PC attempting to "Map Network Drive"

14:52:36,272 DEBUG [org.alfresco.smb.protocol.auth] NT Session setup SPNEGO, MID=8, UID=0, PID=65279
14:52:36,273 DEBUG [org.alfresco.smb.protocol.auth] Kerberos AP-REQ - [AP-REQ:APOptions=MutualAuth ,Ticket=Len=985,Authenticator=EncType=23,Kvno=-1,Len=181]
14:52:36,273 DEBUG [org.alfresco.smb.protocol.auth] Kerberos mutual auth required, parsing AP-REQ
14:52:36,284 DEBUG [org.alfresco.smb.protocol.auth] Using OID MS Kerberos5 for NegTokenTarg
14:52:36,286 DEBUG [org.alfresco.smb.protocol.auth] Created NegTokenTarg using updated AP-REP, added subkey
14:52:36,286 DEBUG [org.alfresco.smb.protocol.auth] Machine account logon, <client PC name>$, as null logon
14:52:36,286 DEBUG [org.alfresco.smb.protocol.auth] Logged on using Kerberos, user <client PC name>$
14:52:36,286 DEBUG [org.alfresco.smb.protocol.auth] User  logged on  (type Null)
14:52:36,286 DEBUG [org.alfresco.smb.protocol.auth] Allocated UID=0 for VC=[0:0,[:null,Windows XP 3790 Service Pack 2,,<client pc IP>],Tree=0,Searches=0]
14:52:38,561 DEBUG [org.alfresco.smb.protocol.auth] NT Session setup SPNEGO, MID=24, UID=0, PID=65279
14:52:38,562 DEBUG [org.alfresco.smb.protocol.auth] User  logged on  (type Normal)
14:52:38,563 DEBUG [org.alfresco.smb.protocol.auth] NT Session setup SPNEGO, MID=32, UID=0, PID=65279
14:52:38,569 WARN  [org.alfresco.smb.protocol.auth] Authentication component does not support MD4 password hashes‍‍‍‍‍‍‍‍‍‍‍‍‍

The following are ALL of the configuration files I have changed to achieve NTLM Authentication against the Active Directory server (NOTE: I do not re-list the files changed in the first post of this thread unless they changed again for NTLM authentication to work):
/opt/alfresco/tomcat/webapps/alfresco/WEB-INF/web.xml (NOTE: Here I show the changed areas only)

…
   <filter>
      <filter-name>Authentication Filter</filter-name>
      <!– <filter-class>org.alfresco.web.app.servlet.AuthenticationFilter</filter-class> –>
      <!– For Novell IChain support use the following filter –>
      <!– <filter-class>org.alfresco.web.app.servlet.NovellIChainsHTTPRequestAuthenticationFilter</filter-class> –>
      <!– For NTLM authentication support use the following filter –>
      <filter-class>org.alfresco.web.app.servlet.NTLMAuthenticationFilter</filter-class>
   </filter>

   <filter>
      <filter-name>WebDAV Authentication Filter</filter-name>
      <!– <filter-class>org.alfresco.repo.webdav.auth.AuthenticationFilter</filter-class> –>
      <!– For NTLM authentication support use the following filter –>
      <filter-class>org.alfresco.repo.webdav.auth.NTLMAuthenticationFilter</filter-class>
   </filter>
…
   <!– For NTLM authentication support enable the following mapping –>
   <filter-mapping>
      <filter-name>Authentication Filter</filter-name>
      <url-pattern>/navigate/*</url-pattern>
   </filter-mapping>

   <filter-mapping>
      <filter-name>Authentication Filter</filter-name>
      <url-pattern>/command/*</url-pattern>
   </filter-mapping>

   <filter-mapping>
      <filter-name>Authentication Filter</filter-name>
      <url-pattern>/download/*</url-pattern>
   </filter-mapping>

   <filter-mapping>
      <filter-name>Authentication Filter</filter-name>
      <url-pattern>/template/*</url-pattern>
   </filter-mapping>

   <filter-mapping>
      <filter-name>Authentication Filter</filter-name>
      <url-pattern>/n/*</url-pattern>
   </filter-mapping>

   <filter-mapping>
      <filter-name>Authentication Filter</filter-name>
      <url-pattern>/c/*</url-pattern>
   </filter-mapping>

   <filter-mapping>
      <filter-name>Authentication Filter</filter-name>
      <url-pattern>/t/*</url-pattern>
   </filter-mapping>

   <filter-mapping>
      <filter-name>Authentication Filter</filter-name>
      <url-pattern>/d/*</url-pattern>
   </filter-mapping>
…
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

/opt/alfresco/tomcat/shared/classes/alfresco/extension/ntlm-authentication-context.xml (NOTE: This file created from existing ntlm-authentication-context.xml.sample)

<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE beans PUBLIC '-//SPRING//DTD BEAN//EN' 'http://www.springframework.org/dtd/spring-beans.dtd'>
<beans>
   <bean id="authenticationDao" class="org.alfresco.repo.security.authentication.ntlm.NullMutableAuthenticationDao" />
   <!– The authentication component.                                      –>
   <!– Use the passthru authentication component to authenticate using    –>
   <!– user accounts on one or more Windows servers.                      –>
   <!– Properties that specify the server(s) to use for passthru          –>
   <!– authentication :-                                                  –>
   <!–   useLocalServer   use the local server for authentication         –>
   <!–   domain           use domain controllers from the specified domain–>
   <!–   servers          comma delimted list of server addresses or      –>
   <!–                    names                                           –>
   <bean id="authenticationComponent"
         class="org.alfresco.repo.security.authentication.ntlm.NTLMAuthenticationComponentImpl"
         parent="authenticationComponentBase">
      <property name="servers"> <value>adserver.my.domain.com</value> </property>
      <property name="personService"> <ref bean="personService" /> </property>
      <property name="nodeService"> <ref bean="nodeService" /> </property>
      <property name="transactionService"> <ref bean="transactionComponent" /> </property>
      <property name="guestAccess"> <value>false</value> </property>
   </bean>
</beans>‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

/opt/alfresco/tomcat/shared/classes/alfresco/extension/file-servers-custom.xml

<alfresco-config area="file-servers">
   <config evaluator="string-compare" condition="Filesystems" replace="true">
      <filesystems>
         <filesystem name="Alfresco">
            <store>workspace://SpacesStore</store>
            <rootPath>/app:company_home</rootPath>
            <urlFile>
               <filename>__Alfresco.url</filename>
               <webpath>http://${localname}:8080/alfresco/</webpath>
            </urlFile>
            <offlineFiles/>
            <desktopActions>
               <global>
                  <path>alfresco/desktop/Alfresco.exe</path>
                  <webpath>http://${localname}:8080/alfresco/</webpath>
               </global>
               <action>
                  <class>org.alfresco.filesys.repo.desk.CheckInOutDesktopAction</class>
                  <name>CheckInOut</name>
                  <filename>__CheckInOut.exe</filename>
               </action>
               <action>
                  <class>org.alfresco.filesys.repo.desk.JavaScriptDesktopAction</class>
                  <name>JavaScriptURL</name>
                  <filename>__ShowDetails.exe</filename>
                  <script>alfresco/desktop/showDetails.js</script>
                  <attributes>anyFiles</attributes>
                  <preprocess>copyToTarget</preprocess>
               </action>
            </desktopActions>
         </filesystem>
         <avmfilesystem name="AVM">
            <virtualView/>
         </avmfilesystem>
      </filesystems>
   </config>

   <config evaluator="string-compare" condition="CIFS Server" replace="true">
      <serverEnable enabled="true"/>
      <host name="${cifs.localname}" domain="${cifs.domain}"/>
      <comment>Alfresco CIFS Server</comment>
      <broadcast>${cifs.broadcast}</broadcast>
      <tcpipSMB port="1445" platforms="linux,solaris,macosx"/>
      <netBIOSSMB sessionPort="1139" namePort="1137" datagramPort="1138" platforms="linux,solaris,macosx"/>
      <hostAnnounce interval="5"/>
      <Win32NetBIOS/>
      <Win32Announce interval="5"/>
      <authenticator type="enterprise">
         <KDC>adserver.my.domain.com</KDC>
         <Realm>MY.REALM.COM</Realm>
         <Password>password</Password>
         <Principal>cifs/adserver.my.domain.com</Principal>
      </authenticator>
      <sessionDebug flags="Negotiate,Socket"/>
   </config>

   <config evaluator="string-compare" condition="Filesystem Security" replace="true">
      <authenticator type="enterprise">
      </authenticator>
   </config>

</alfresco-config>‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

/usr/local/java/jdk1.6.0_11/jre/lib/security/java.security (NOTE: Here I show the changed areas only)

…
login.config.url.1=file:${java.home}/lib/security/java.login.config
…‍‍‍

/usr/local/java/jdk1.6.0_11/jre/lib/security/java.login.config

AlfrescoCIFS {
   com.sun.security.auth.module.Krb5LoginModule required
   storeKey=true
   useKeyTab=true
   keyTab="/etc/alfservercifs.keytab"
   principal="cifs/alfserver.my.domain.com";
};

AlfrescoHTTP {
   com.sun.security.auth.module.Krb5LoginModule required
   storeKey=true
   useKeyTab=true
   keyTab="/etc/alfserverhttp.keytab"
   principal="HTTP/alfserver.my.domain.com";
};‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

The above config produces the following output in alfresco.log when the "alfresco.sh start" command is issued:

14:25:23,418 INFO  [org.alfresco.config.xml.XMLConfigService$PropertyConfigurer] Loading properties file from class path resource [alfresco/file-servers.properties]
14:25:24,141 DEBUG [org.alfresco.repo.webdav.auth.NTLMAuthenticationFilter] preRegister called. Server=com.sun.jmx.mbeanserver.JmxMBeanServer@201787a6, name=log4j:logger=org.alfresco.repo.webdav.auth.NTLMAuthenticationFilter
14:25:24,142 DEBUG [org.alfresco.smb.protocol.auth] preRegister called. Server=com.sun.jmx.mbeanserver.JmxMBeanServer@201787a6, name=log4j:logger=org.alfresco.smb.protocol.auth
14:25:24,143 DEBUG [org.alfresco.web.app.servlet.NTLMAuthenticationFilter] preRegister called. Server=com.sun.jmx.mbeanserver.JmxMBeanServer@201787a6, name=log4j:logger=org.alfresco.web.app.servlet.NTLMAuthenticationFilter
14:25:28,291 INFO  [org.alfresco.repo.domain.schema.SchemaBootstrap] Schema managed by database dialect org.hibernate.dialect.MySQLInnoDBDialect.
14:25:28,620 INFO  [org.alfresco.repo.domain.schema.SchemaBootstrap] No changes were made to the schema.
14:25:29,693 INFO  [org.alfresco.repo.admin.ConfigurationChecker] The Alfresco root data directory ('dir.root') is: /opt/alfresco/alf_data
14:25:29,802 INFO  [org.alfresco.repo.admin.patch.PatchExecuter] Checking for patches to apply …
14:25:29,964 INFO  [org.alfresco.repo.admin.patch.PatchExecuter] No patches were required.
14:25:29,967 INFO  [org.alfresco.repo.module.ModuleServiceImpl] Found 0 module(s).
14:25:30,247 INFO  [org.alfresco.service.descriptor.DescriptorService] Alfresco JVM - v1.6.0_11-b03; maximum heap size 910.250MB
14:25:30,247 INFO  [org.alfresco.service.descriptor.DescriptorService] Alfresco started (Labs): Current version 3.0.0 (c 1342) schema 1000 - Installed version 3.0.0 (c 1342) schema 1000
14:25:30,351 WARN  [org.alfresco.linkvalidation.LinkValidationServiceImpl] LinkValidationService Update is not running (virtualization server not registered or started)
14:25:40,070 INFO  [org.alfresco.web.scripts.DeclarativeRegistry] Registered 21 Web Scripts (+0 failed), 23 URLs
14:25:40,071 INFO  [org.alfresco.web.scripts.AbstractRuntimeContainer] Initialised Presentation Web Script Container (in 65.541ms)
14:25:40,250 INFO  [org.alfresco.web.scripts.DeclarativeRegistry] Registered 134 Web Scripts (+0 failed), 136 URLs
14:25:40,250 INFO  [org.alfresco.web.scripts.AbstractRuntimeContainer] Initialised WebFramework Web Script Container (in 176.483ms)
14:25:40,270 INFO  [org.alfresco.web.site.FrameworkHelper] Successfully Initialized Web Framework
14:26:11,531 INFO  [org.alfresco.web.site.FrameworkHelper] Successfully Initialized Web Framework‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Again, the result of the above configuration is that no user can use the Windows XP "Map Network Drive…" function to map the CIFS server as a shared drive.

Where is the error in this configuration?

Re: [ERROR]Alfresco Engineers: CIFS auth does not work. Sugg?

mrogers — Tue, 13 Jan 2009 20:35:11 GMT

I suggest you try your tests on HEAD rather than 3c. There are known issues with CIFS authentication on 3c such as ALFCOM-2165.

Re: [ERROR]Alfresco Engineers: CIFS auth does not work. Sugg?

meansartin14 — Tue, 13 Jan 2009 20:45:01 GMT

I have attempted to link the following threads here to focus our collective minds on this problem:
— I got authentication with Active Directory working
— Alfresco user/pw must match AD user/pw for Map Network Drive
— Labs 3c + external AD auth + SSO... Need some direction
— Frustrating CIFS config issue... Help?
— Configuring CIFS for Kerberos/AD integration PROBLEM!!
— Active Directory Integration: Seriously very broken
— sts=Disallow via passthru
— Alfresco 3.0 Enterprise, CIFS & Kerberos
— CIFS conf problem (KrbException: Indentifier doesn't match...
— Problem with accessing CFIS share from windows
— Alfresco and Samba - Could not connect to CIFS.

Hopefully, everyone having issues in those threads will find there answer here eventually.

Re: [ERROR]Alfresco Engineers: CIFS auth does not work. Sugg?

meansartin14 — Tue, 13 Jan 2009 20:49:13 GMT

I suggest you try your tests on HEAD rather than 3c. There are known issues with CIFS authentication on 3c such as ALFCOM-2165.

Where can I find the "HEAD" version of Alfresco? And is this an official release?

Re: [ERROR]Alfresco Engineers: CIFS auth does not work. Sugg?

mrogers — Tue, 13 Jan 2009 23:33:46 GMT

HEAD is the very latest version of Alfresco.
You check it out from SVN and build it yourself.

There is no point in testing CIFS on 3c or any other versions since there are known issues that have already been raised in JIRA. If you want to contribute towards getting a better version of Alfresco concentrate upon the current issues and add detail to the JIRA tickets.

Re: [ERROR]Alfresco Engineers: CIFS auth does not work. Sugg?

rxm307 — Tue, 13 Jan 2009 23:58:49 GMT

Here is the link to the JIRA ticket

https://issues.alfresco.com/jira/browse/ALFCOM-2165

Re: [ERROR]Alfresco Engineers: CIFS auth does not work. Sugg?

wuff — Wed, 14 Jan 2009 09:54:15 GMT

Just a short question:
Is there a possibility, to get SSO working with Kerberos?
I realized SSO with Apache/WebDav/Subversion on a Linuxserver, using kerberos and serviceprincipals against AD, works like a charm.
Following this guide:
http://wiki.alfresco.com/wiki/Configuring_the_CIFS_and_web_servers_for_Kerberos/AD_integration
i wondered, why i need to store Password in configfile.. with the generated keytab for the serviceprincipal, it shouldn't be necessary?

In general: Is there a possibilty, to setup Alfresco to use (SingleSignOn!)-kerberos authentication for webservice and share access?

Re: [ERROR]Alfresco Engineers: CIFS auth does not work. Sugg?

meansartin14 — Wed, 14 Jan 2009 13:51:54 GMT

HEAD is the very latest version of Alfresco.
You check it out from SVN and build it yourself.

There is no point in testing CIFS on 3c or any other versions since there are known issues that have already been raised in JIRA. If you want to contribute towards getting a better version of Alfresco concentrate upon the current issues and add detail to the JIRA tickets.

What is the latest non-Enterprise released version (not requiring compilation) where CIFS is known to function properly with Active Directory authentication?

I have tried both Labs 3c and Community 2.9.0B without success.

Also, if there are known issues, what (generally) is the solution provided by Alfresco to Enterprise customers?

Re: [ERROR]Alfresco Engineers: CIFS auth does not work. Sugg?

meansartin14 — Wed, 14 Jan 2009 22:13:44 GMT

What is the latest non-Enterprise released version (not requiring compilation) where CIFS is known to function properly with Active Directory authentication?

I have tried both Labs 3c and Community 2.9.0B without success.

Also, if there are known issues, what (generally) is the solution provided by Alfresco to Enterprise customers?

Add Alfresco Community 2.1R1 to the above list. I tried that today without any ability to "Map Network Drive" to the Alfresco CIFS server. This was the case in both "out-of-the-box" configuration, and my implementation-specific configuration.

Re: [ERROR]Alfresco Engineers: CIFS auth does not work. Sugg?

mikeh — Wed, 14 Jan 2009 22:42:05 GMT

Hi

Could you try adding a <disableNTLM/> config tag to the "CIFS Server" section of file-servers-custom.xml ? It means you won't be able to do non-domain logons, but would be interesting to see if it solves the immediate issue.

As Mark says above, this should be tried on either HEAD (Labs 3D-dev) or Enterprise 3.0 SP1.

Thanks,
Mike

Re: [ERROR]Alfresco Engineers: CIFS auth does not work. Sugg?

meansartin14 — Thu, 15 Jan 2009 19:26:40 GMT

Could you try adding a <disableNTLM/> config tag to the "CIFS Server" section of file-servers-custom.xml ? It means you won't be able to do non-domain logons, but would be interesting to see if it solves the immediate issue.

As Mark says above, this should be tried on either HEAD (Labs 3D-dev) or Enterprise 3.0 SP1.

Mike - I just went ahead and tried your suggestion. It changed the output to alfresco.log when attempting a "Map Network Drive", but still did not work. Here is the file I changed and the output to alfresco.log.
/opt/alfresco/tomcat/shared/classes/alfresco/extension/file-servers-custom.xml

<alfresco-config area="file-servers">
   <config evaluator="string-compare" condition="Filesystems" replace="true">
      <filesystems>
         <filesystem name="Alfresco">
            <store>workspace://SpacesStore</store>
            <rootPath>/app:company_home</rootPath>
            <urlFile>
               <filename>__Alfresco.url</filename>
               <webpath>http://${localname}:8080/alfresco/</webpath>
            </urlFile>
            <offlineFiles/>
            <desktopActions>
               <global>
                  <path>alfresco/desktop/Alfresco.exe</path>
                  <webpath>http://${localname}:8080/alfresco/</webpath>
               </global>
               <action>
                  <class>org.alfresco.filesys.repo.desk.CheckInOutDesktopAction</class>
                  <name>CheckInOut</name>
                  <filename>__CheckInOut.exe</filename>
               </action>
               <action>
                  <class>org.alfresco.filesys.repo.desk.JavaScriptDesktopAction</class>
                  <name>JavaScriptURL</name>
                  <filename>__ShowDetails.exe</filename>
                  <script>alfresco/desktop/showDetails.js</script>
                  <attributes>anyFiles</attributes>
                  <preprocess>copyToTarget</preprocess>
               </action>
            </desktopActions>
         </filesystem>
         <avmfilesystem name="AVM">
            <virtualView/>
         </avmfilesystem>
      </filesystems>
   </config>

   <config evaluator="string-compare" condition="CIFS Server" replace="true">
      <serverEnable enabled="true"/>
      <host name="${cifs.localname}" domain="${cifs.domain}"/>
      <comment>Alfresco CIFS Server</comment>
      <broadcast>${cifs.broadcast}</broadcast>
      <tcpipSMB port="1445" platforms="linux,solaris,macosx"/>
      <netBIOSSMB sessionPort="1139" namePort="1137" datagramPort="1138" platforms="linux,solaris,macosx"/>
      <hostAnnounce interval="5"/>
      <Win32NetBIOS/>
      <Win32Announce interval="5"/>
      <authenticator type="enterprise">
         <KDC>adserver.my.domain.com</KDC>
         <Realm>MY.REALM.COM</Realm>
         <Password>…</Password>
         <Principal>cifs/alfserver.my.domain.com</Principal>
         <disableNTLM/>
      </authenticator>
      <sessionDebug flags="Negotiate,Socket"/>
   </config>

   <config evaluator="string-compare" condition="Filesystem Security" replace="true">
      <authenticator type="enterprise">
      </authenticator>
   </config>

</alfresco-config>‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

/opt/alfresco/alfresco.log (NOTE: This is the result from the "alfresco.sh start" command)

14:08:03,101 INFO  [org.alfresco.config.xml.XMLConfigService$PropertyConfigurer] Loading properties file from class path resource [alfresco/file-servers.properties]
14:08:03,744 DEBUG [org.alfresco.repo.webdav.auth.NTLMAuthenticationFilter] preRegister called. Server=com.sun.jmx.mbeanserver.JmxMBeanServer@59596138, name=log4j:logger=org.alfresco.repo.webdav.auth.NTLMAuthenticationFilter
14:08:03,744 DEBUG [org.alfresco.smb.protocol.auth] preRegister called. Server=com.sun.jmx.mbeanserver.JmxMBeanServer@59596138, name=log4j:logger=org.alfresco.smb.protocol.auth
14:08:03,745 DEBUG [org.alfresco.web.app.servlet.NTLMAuthenticationFilter] preRegister called. Server=com.sun.jmx.mbeanserver.JmxMBeanServer@59596138, name=log4j:logger=org.alfresco.web.app.servlet.NTLMAuthenticationFilter
14:08:07,475 INFO  [org.alfresco.repo.domain.schema.SchemaBootstrap] Schema managed by database dialect org.hibernate.dialect.MySQLInnoDBDialect.
14:08:07,854 INFO  [org.alfresco.repo.domain.schema.SchemaBootstrap] No changes were made to the schema.
14:08:08,907 INFO  [org.alfresco.repo.admin.ConfigurationChecker] The Alfresco root data directory ('dir.root') is: /opt/alfresco/alf_data
14:08:08,939 INFO  [org.alfresco.repo.admin.patch.PatchExecuter] Checking for patches to apply …
14:08:09,104 INFO  [org.alfresco.repo.admin.patch.PatchExecuter] No patches were required.
14:08:09,107 INFO  [org.alfresco.repo.module.ModuleServiceImpl] Found 0 module(s).
14:08:09,411 DEBUG [org.alfresco.smb.protocol.auth] Logged on using principal cifs/alfserver.my.domain.com@MY.REALM.COM
14:08:09,411 DEBUG [org.alfresco.smb.protocol.auth] Enabling mechTypes :-
14:08:09,411 DEBUG [org.alfresco.smb.protocol.auth]   Kerberos5
14:08:09,411 DEBUG [org.alfresco.smb.protocol.auth]   MS-Kerberos5
14:08:09,637 INFO  [org.alfresco.service.descriptor.DescriptorService] Alfresco JVM - v1.6.0_11-b03; maximum heap size 910.250MB
14:08:09,637 INFO  [org.alfresco.service.descriptor.DescriptorService] Alfresco started (Labs): Current version 3.0.0 (c 1342) schema 1000 - Installed version 3.0.0 (c 1342) schema 1000
14:08:09,752 WARN  [org.alfresco.linkvalidation.LinkValidationServiceImpl] LinkValidationService Update is not running (virtualization server not registered or started)
14:08:18,497 INFO  [org.alfresco.web.scripts.DeclarativeRegistry] Registered 21 Web Scripts (+0 failed), 23 URLs
14:08:18,498 INFO  [org.alfresco.web.scripts.AbstractRuntimeContainer] Initialised Presentation Web Script Container (in 63.338ms)
14:08:18,669 INFO  [org.alfresco.web.scripts.DeclarativeRegistry] Registered 134 Web Scripts (+0 failed), 136 URLs
14:08:18,669 INFO  [org.alfresco.web.scripts.AbstractRuntimeContainer] Initialised WebFramework Web Script Container (in 168.63ms)
14:08:18,689 INFO  [org.alfresco.web.site.FrameworkHelper] Successfully Initialized Web Framework
14:08:50,064 INFO  [org.alfresco.web.site.FrameworkHelper] Successfully Initialized Web Framework‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

"Map Network Drive" (Drive: Z: ; Folder: \\alfserver\alfresco), click Finish

14:21:22,067 DEBUG [org.alfresco.smb.protocol.auth] NT Session setup SPNEGO, MID=8, UID=0, PID=65279
14:21:22,072 DEBUG [org.alfresco.smb.protocol.auth] Kerberos AP-REQ - [AP-REQ:APOptions=MutualAuth ,Ticket=Len=985,Authenticator=EncType=23,Kvno=-1,Len=181]
14:21:22,073 DEBUG [org.alfresco.smb.protocol.auth] Kerberos mutual auth required, parsing AP-REQ
14:21:22,163 DEBUG [org.alfresco.smb.protocol.auth] Using OID MS Kerberos5 for NegTokenTarg
14:21:22,167 DEBUG [org.alfresco.smb.protocol.auth] Created NegTokenTarg using updated AP-REP, added subkey
14:21:22,167 DEBUG [org.alfresco.smb.protocol.auth] Machine account logon, client PC name>$, as null logon
14:21:22,167 DEBUG [org.alfresco.smb.protocol.auth] Logged on using Kerberos, user <client PC name>$
14:21:22,168 DEBUG [org.alfresco.smb.protocol.auth] User  logged on  (type Null)
14:21:22,170 DEBUG [org.alfresco.smb.protocol.auth] Allocated UID=0 for VC=[0:0,[:null,Windows XP 3790 Service Pack 2,,128.183.223.147],Tree=0,Searches=0]
14:21:22,214 DEBUG [org.alfresco.smb.protocol.auth] NT Session setup SPNEGO, MID=24, UID=0, PID=65279
14:21:22,215 DEBUG [org.alfresco.smb.protocol.auth] Kerberos AP-REQ - [AP-REQ:APOptions=MutualAuth ,Ticket=Len=1020,Authenticator=EncType=23,Kvno=-1,Len=176]
14:21:22,215 DEBUG [org.alfresco.smb.protocol.auth] Kerberos mutual auth required, parsing AP-REQ
14:21:22,225 DEBUG [org.alfresco.smb.protocol.auth] Using OID MS Kerberos5 for NegTokenTarg
14:21:22,226 DEBUG [org.alfresco.smb.protocol.auth] Created NegTokenTarg using updated AP-REP, added subkey
14:21:22,245 DEBUG [org.alfresco.smb.protocol.auth] Logged on using Kerberos, user <user>
14:21:22,246 DEBUG [org.alfresco.smb.protocol.auth] User <user>@MY.REALM.COM logged on  (type Normal)
14:21:22,246 DEBUG [org.alfresco.smb.protocol.auth] Allocated UID=1 for VC=[1:1,[<user>@MY.REALM.COM:null,Windows XP 3790 Service Pack 2,,123.234.123.147],Tree=0,Searches=0]‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

"Map Network Drive" (Drive: Z: ; Folder: \\alfserver\alfresco), click "Connect using a different user name" (User name: Alfresco\<user>); Note that <user> is the same value entered when logging into the client PC attempting to "Map Network Drive"

14:23:49,828 DEBUG [org.alfresco.smb.protocol.auth] NT Session setup SPNEGO, MID=8, UID=0, PID=65279
14:23:49,829 DEBUG [org.alfresco.smb.protocol.auth] Kerberos AP-REQ - [AP-REQ:APOptions=MutualAuth ,Ticket=Len=985,Authenticator=EncType=23,Kvno=-1,Len=181]
14:23:49,829 DEBUG [org.alfresco.smb.protocol.auth] Kerberos mutual auth required, parsing AP-REQ
14:23:49,833 DEBUG [org.alfresco.smb.protocol.auth] Using OID MS Kerberos5 for NegTokenTarg
14:23:49,834 DEBUG [org.alfresco.smb.protocol.auth] Created NegTokenTarg using updated AP-REP, added subkey
14:23:49,834 DEBUG [org.alfresco.smb.protocol.auth] Machine account logon, <client PC name>$, as null logon
14:23:49,834 DEBUG [org.alfresco.smb.protocol.auth] Logged on using Kerberos, user <client PC name>$
14:23:49,834 DEBUG [org.alfresco.smb.protocol.auth] User  logged on  (type Null)
14:23:49,835 DEBUG [org.alfresco.smb.protocol.auth] Allocated UID=0 for VC=[0:0,[:null,Windows XP 3790 Service Pack 2,,128.183.223.147],Tree=0,Searches=0]‍‍‍‍‍‍‍‍‍

Still searching for the answer…

Re: [ERROR]Alfresco Engineers: CIFS auth does not work. Sugg?

toyboy — Thu, 15 Jan 2009 20:55:06 GMT

Anyone at alfresco know if Cifs with AD can actually be done? a simple yes of no answer would be good because there are so many conflicting reports some people seem to get it working and then some say it cant be done because of cifs bugs?
If we cant get cifs working against AD properly with SSO there is no point in me continuing with this and i'll have to start testing out sharepoint for the company as there seems to be no alternative available.

Re: [ERROR]Alfresco Engineers: CIFS auth does not work. Sugg?

meansartin14 — Fri, 16 Jan 2009 16:25:32 GMT

I am now trying a trial version of Alfresco Enterprise 3.0.1. Applied the same configuration as used in the first 2 posts of this thread for Labs 3c and still seeing the same issues.

I refuse to believe that the CIFS server does not work in all of the Alfresco versions I've tried. What am I doing wrong? Could this be a client-side issue?

I would really like to explore what could be causing this issue on the client side of things, but the problem is I don't know where to look or what to look for. Again, we're hosting Alfresco on a RHEL 5.2 server (running under a non-root account), which is attempting to be accessed via CIFS by Windows XP Professional SP3 (and a few x64 SP2 PCs, of which my PC is one) PCs. All I need is for CIFS to work.

There has to be an answer out there somewhere…

Re: [ERROR]Alfresco Engineers: CIFS auth does not work. Sugg?

meansartin14 — Fri, 16 Jan 2009 17:41:00 GMT

I would really like to explore what could be causing this issue on the client side of things, but the problem is I don't know where to look or what to look for. Again, we're hosting Alfresco on a RHEL 5.2 server (running under a non-root account), which is attempting to be accessed via CIFS by Windows XP Professional SP3 (and a few x64 SP2 PCs, of which my PC is one) PCs. All I need is for CIFS to work.

There has to be an answer out there somewhere…

Based on the following Microsoft Support Knowledge Base article, I am starting to think the issue I'm experiencing is directly related to group policy-level configuration. Here's the article, for reference:
http://support.microsoft.com/kb/281648

I am now in the process of exploring our group policy-level configuration and figuring out what could be an issue… I will report back.

Re: [ERROR]Alfresco Engineers: CIFS auth does not work. Sugg?

ivan_plestina — Sat, 17 Jan 2009 22:08:58 GMT

I've managed to get CIFS to work with Alfresco 3d-dev nightly build from Jan 02. It contains some fixes from the enterprise version. It's a Windows 2003 server 32-bit in an AD environment. Same config on 64-bit won't work (tho it's a lot larger repository so it might be related to that). It seems up but accessing it just locks processor and then dies after a while. Java.exe remains using 50% proc.

Config:

ntlm-authentication-context.xml (note the usage of BOTH domain\server,server!):


<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE beans PUBLIC '-//SPRING//DTD BEAN//EN' 'http://www.springframework.org/dtd/spring-beans.dtd'>

<beans>

   <bean id="authenticationDao" class="org.alfresco.repo.security.authentication.DefaultMutableAuthenticationDao" >
         <property name="allowSetEnabled" value="true" />
         <property name="allowGetEnabled" value="true" />
         <property name="allowDeleteUser" value="true" />
         <property name="allowCreateUser" value="true" />
   </bean>


   <!– The authentication component.                                      –>

   <!– Use the passthru authentication component to authenticate using    –>
   <!– user accounts on one or more Windows servers.                      –>

   <!– Properties that specify the server(s) to use for passthru          –>
   <!– authentication :-                                                  –>
   <!–   useLocalServer   use the local server for authentication         –>
   <!–   domain           use domain controllers from the specified domain–>
   <!–   servers          comma delimted list of server addresses or      –>
   <!–                    names                                           –>

   <bean id="authenticationComponent"
         class="org.alfresco.repo.security.authentication.ntlm.NTLMAuthenticationComponentImpl"
         parent="authenticationComponentBase">
       <property name="useLocalServer">
           <value>false</value>
       </property>
       <property name="servers">
           <value>DOMAIN\DC,DC</value>
       </property>
       <property name="personService">
           <ref bean="personService" />
       </property>
       <property name="nodeService">
           <ref bean="nodeService" />
       </property>
       <property name="transactionService">
           <ref bean="transactionComponent" />
       </property>
       <property name="guestAccess">
           <value>false</value>
       </property>
   </bean>

</beans>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

file-servers-custom.xml


<alfresco-config area="file-servers">

   <!– To override the default Alfresco filesystem use replace="true", to –>
   <!– add additional filesystems remove the replace="true" attribute     –>
    <config evaluator="string-compare" condition="CIFS Server" replace="true">
     <serverEnable enabled="true"/>
      <host name="${cifs.localname}_A" domain="${cifs.domain}"/>
      <comment>Alfresco CIFS Server</comment>

      <!– Set to the broadcast mask for the subnet –>
      <broadcast>${cifs.broadcast}</broadcast>

      <!– Use Java socket based NetBIOS over TCP/IP and native SMB on linux –>
<!–
      <tcpipSMB platforms="linux,solaris,macosx"/>
      <netBIOSSMB platforms="linux,solaris,macosx"/>
–>
      <!– Can be mapped to non-privileged ports, then use firewall rules to forward
          requests from the standard ports –>
     <!–       
      <tcpipSMB port="1445" platforms="linux,solaris,macosx"/>
      <netBIOSSMB sessionPort="1139" namePort="1137" datagramPort="1138" platforms="linux,solaris,macosx"/>
     –>
       
      <hostAnnounce interval="5"/>

      <!– Use Win32 NetBIOS interface on Windows –>
      <Win32NetBIOS/>
      <Win32Announce interval="5"/>

      <!– CIFS authentication –>
      <authenticator type="alfresco">
      </authenticator>
      
<!–
      <WINS>
         <primary>1.2.3.4</primary>
         <secondary>5.6.7.8</secondary>
      </WINS>
–>
      <sessionDebug flags="Negotiate,Socket"/>
   </config>
  
   <config evaluator="string-compare" condition="Filesystems" replace="true">
      <filesystems>

         <filesystem name="Alfresco">
            <store>workspace://SpacesStore</store>
            <rootPath>/app:company_home</rootPath>

            <!– Add a URL file to each folder that links back to the web client –>
            <urlFile>
               <filename>__Alfresco.url</filename>
               <webpath>http://${localname}:8080/alfresco/</webpath>
            </urlFile>

            <!– Mark locked files as offline –>
            <offlineFiles/>

            <!– Desktop actions –>

            <desktopActions>
               <global>
                  <path>alfresco/desktop/Alfresco.exe</path>
                  <webpath>http://${localname}:8080/alfresco/</webpath>
               </global>
               <action>
                  <class>org.alfresco.filesys.repo.desk.CheckInOutDesktopAction</class>
                  <name>CheckInOut</name>
                  <filename>__CheckInOut.exe</filename>
               </action>
               <action>
                  <class>org.alfresco.filesys.repo.desk.JavaScriptDesktopAction</class>
                  <name>JavaScriptURL</name>
                  <filename>__ShowDetails.exe</filename>
                  <script>alfresco/desktop/showDetails.js</script>
                  <attributes>anyFiles</attributes>
                  <preprocess>copyToTarget</preprocess>
               </action>

            </desktopActions>

<!–
            <accessControl default="Write">
               <user name="admin" access="Write"/>
               <address subnet="90.1.0.0" mask="255.255.0.0" access="Write"/>
            </accessControl>
–>
         </filesystem>
        
       <!– AVM virtualization view of all stores/versions for WCM –>
         <avmfilesystem name="AVM">
            <virtualView/>
         </avmfilesystem>
        
      </filesystems>
   </config>

</alfresco-config>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

file-server.properties:


cifs.localname=${localname}
cifs.domain=DOMAIN
cifs.broadcast=172.16.1.255
‍‍‍‍‍

+ usual NTLM changes in web.xml

Note that we can't access CIFS on any Alfresco version from XP SP3 or Vista SP1 computers. If anyone has a clue how to fix this on client side…

Hope this helps.

Re: [ERROR]Alfresco Engineers: CIFS auth does not work. Sugg?

meansartin14 — Mon, 19 Jan 2009 13:38:47 GMT

I've managed to get CIFS to work with Alfresco 3d-dev nightly build from Jan 02. It contains some fixes from the enterprise version. It's a Windows 2003 server 32-bit in an AD environment. Same config on 64-bit won't work (tho it's a lot larger repository so it might be related to that). It seems up but accessing it just locks processor and then dies after a while. Java.exe remains using 50% proc.

… SNIP …

Note that we can't access CIFS on any Alfresco version from XP SP3 or Vista SP1 computers. If anyone has a clue how to fix this on client side…

The first issue you mention (locking up all CPU utilization, then Alfresco dying) I am completely unfamiliar with. Alfresco is installed on RedHat Enterprise Linux 5.2 in an Active Directory environment and I have not experienced the issue you mention.

The second issue you mention is exactly what I am currently investigating; client-side group policies that may be preventing CIFS access. I too have been completely unable to get CIFS working on ANY Alfresco version I've tried. Unfortunately, I do not control the group policy configurations; I have to wait on a third party to a) allow/approve the changes and b) make the changes. Here's my latest post where I linked some Microsoft documentation that may just be the answer to our problem:

Based on the following Microsoft Support Knowledge Base article, I am starting to think the issue I'm experiencing is directly related to group policy-level configuration. Here's the article, for reference:
http://support.microsoft.com/kb/281648

I am now in the process of exploring our group policy-level configuration and figuring out what could be an issue… I will report back.

Re: [ERROR]Alfresco Engineers: CIFS auth does not work. Sugg?

ivan_plestina — Mon, 19 Jan 2009 13:55:39 GMT

I've managed to get CIFS to work with Alfresco 3d-dev nightly build from Jan 02. It contains some fixes from the enterprise version. It's a Windows 2003 server 32-bit in an AD environment. Same config on 64-bit won't work (tho it's a lot larger repository so it might be related to that). It seems up but accessing it just locks processor and then dies after a while. Java.exe remains using 50% proc.

… SNIP …

Note that we can't access CIFS on any Alfresco version from XP SP3 or Vista SP1 computers. If anyone has a clue how to fix this on client side…

The first issue you mention (locking up all CPU utilization, then Alfresco dying) I am completely unfamiliar with. Alfresco is installed on RedHat Enterprise Linux 5.2 in an Active Directory environment and I have not experienced the issue you mention.

The second issue you mention is exactly what I am currently investigating; client-side group policies that may be preventing CIFS access. I too have been completely unable to get CIFS working on ANY Alfresco version I've tried. Unfortunately, I do not control the group policy configurations; I have to wait on a third party to a) allow/approve the changes and b) make the changes. Here's my latest post where I linked some Microsoft documentation that may just be the answer to our problem:

Based on the following Microsoft Support Knowledge Base article, I am starting to think the issue I'm experiencing is directly related to group policy-level configuration. Here's the article, for reference:
http://support.microsoft.com/kb/281648

I am now in the process of exploring our group policy-level configuration and figuring out what could be an issue… I will report back.

Hm, actually I've retested the CIFS on Vista SP1 with above configuration I posted and it does seem to work now. You are right about the Windows security settings as the point of failure. Namely LAN Manager Authentication Level parameter in group policy. We've tested this before and when environment was set to use only NTLMv2 hashes we couldn't get NTLM authentication to work. That parameter is set to Send LM & NTLM responses in our AD now and it works perfectly. On the other hand it's less secure. Details about those parameters: http://kb.iu.edu/data/atvn.html. Not sure what is the status of Alfresco supporting NTLMv2 now? Any info? I know it wasn't supported in 2.1.

As for the CIFS locking processor - it only happens on 64bit server. Is your server (java) 32 or 64 bit? Btw it dies on client side. Alfresco still runs normally, proc on 50% or so, then calms down after a while.

Re: [ERROR]Alfresco Engineers: CIFS auth does not work. Sugg?

meansartin14 — Mon, 19 Jan 2009 19:52:24 GMT

Hm, actually I've retested the CIFS on Vista SP1 with above configuration I posted and it does seem to work now. You are right about the Windows security settings as the point of failure. Namely LAN Manager Authentication Level parameter in group policy. We've tested this before and when environment was set to use only NTLMv2 hashes we couldn't get NTLM authentication to work. That parameter is set to Send LM & NTLM responses in our AD now and it works perfectly. On the other hand it's less secure. Details about those parameters: http://kb.iu.edu/data/atvn.html. Not sure what is the status of Alfresco supporting NTLMv2 now? Any info? I know it wasn't supported in 2.1.

As for the CIFS locking processor - it only happens on 64bit server. Is your server (java) 32 or 64 bit? Btw it dies on client side. Alfresco still runs normally, proc on 50% or so, then calms down after a while.

In our case, I have confirmed with the administrators of our group policy settings that we can not change the existing settings.

It seems that Samba may provide the workaround we need. So now, we are going to install and configure Samba on our RHEL 5.2 server in an attempt to allow Alfresco to be mapped as a Network Drive. Apparently, Samba now supports both digital signatures and NTLMv2 hashing, which should get us to where we want to be.

I will keep you informed…

P.S. It would seem that Alfresco needs to give serious consideration to supporting NTLMv2…

Re: [ERROR]Alfresco Engineers: CIFS auth does not work. Sugg?

rxm307 — Tue, 20 Jan 2009 04:33:00 GMT

In my case Send LM & NTLM responses is already set, So I dont think this is the problem.