topic Re: Simplest case of LDAP authentication doesn't work.. pls help in Alfresco Archive

Simplest case of LDAP authentication doesn't work.. pls help

geoffrey1211 — Thu, 19 Mar 2009 23:11:21 GMT

What I want to do is to login on the alfresco login page using ONLY the active directory credentials (I am using Active Directory Server). How can I do this? I keep getting this error:16:27:37,865 WARN [authentication.ldap.LDAPInitialDirContextFactoryImpl] LDAP server supports anonymous bind

Re: Simplest case of LDAP authentication doesn't work.. pls help

jottley — Thu, 19 Mar 2009 23:38:11 GMT

Ignore those messages they are for info only.

Are you able to login using your AD username and password?

If not a couple things I would look at

Your userNameFormat looks a little short…. missing dc attributes. Can you verify what the full DN is?

You can also set log4j.logger.org.alfresco.repo.security.authentication.ldap=debug in the log4j.properties file (tomcat/webapps/alfresco/WEB-INF/classes). Restart Alfresco and you will then see debug info when you try to login.

Re: Simplest case of LDAP authentication doesn't work.. pls help

rxm307 — Fri, 20 Mar 2009 02:17:38 GMT

You can also use the Userprincipal ie username@domain.corp or %s@domain.corp

Re: Simplest case of LDAP authentication doesn't work.. pls help

geoffrey1211 — Fri, 20 Mar 2009 13:53:30 GMT

I am NOT able to login using my AD username and password. I included the debug config, but see nothing regarding login info in the log other than what I shown. Why is Alfresco completely silent about it!? I have NO way of knowing what went wrong…

Regarding my AD structure - it looks like this:


DIT
   Root DSE
      ou=system
         ou=users
             cn=user1
‍‍‍‍‍‍‍

For user1, here are the attributes:
objectClass=inetOrgPerson
objectClass=organizationalPerson
objectClass=person
objectClass=tlsKeyInfo
objectClass=top
cn=user1
keyalgorithm=RSA
privatekey=Binary Data (345 Bytes)
privatekeyformat=PKCS#8
publickey=Binary Data (94 Bytes)
publickeyformat=X.509
sn=surname
displayname=Directory Superuser
givenName=givenname
uid=user1
usercertificate=Binary Data(375 Bytes)
userpassword=Plain text password

? I use simple authentication, so Plain text password is ok right?
? is "dc" required on a distinguished name (dn)? My structure don't use any "dc" attributes
? is synchronisation required in order for authentication to work?
? is there anything AT ALL I can do to see what went wrong?

Re: Simplest case of LDAP authentication doesn't work.. pls help

jottley — Fri, 20 Mar 2009 14:07:05 GMT

? I use simple authentication, so Plain text password is ok right?

This won't work if you plan on using CIFs shared drives which require an MD4 hashed password

? is "dc" required on a distinguished name (dn)? My structure don't use any "dc" attributes

No. As long as it is you are using your DN, or the email address as pointed out by RXM307

? is synchronisation required in order for authentication to work?

No.

? is there anything AT ALL I can do to see what went wrong?

Use the debug flag:

You can also set log4j.logger.org.alfresco.repo.security.authentication.ldap=debug in the log4j.properties file (tomcat/webapps/alfresco/WEB-INF/classes). Restart Alfresco and you will then see debug info when you try to login.

Re: Simplest case of LDAP authentication doesn't work.. pls help

geoffrey1211 — Fri, 20 Mar 2009 14:42:32 GMT

I already included this in log4j.properties
log4j.logger.org.alfresco.repo.security.authentication.ldap=debug

When I try to login using the alfresco login screen, I cannot use my AD credentials, only the alfresco ones. And there's nothing in the log about why it cannot authenticate. It is almost as if it never even tries to hit the AD.

Is there anyway to know whether or not it hits the AD? Is there anything that I have not done? I enabled the ldap-authentication-context.xml w/ changes to the properties file:
a. <bean name="authenticationDao" . . . to <bean name="authenticationDaoLDAP"
b. <bean id="authenticationComponent" to <bean id="authenticationComponentLDAP"
Is there anything else that needs to be done?

My ultimate goal is to have a secure login (maybe using SSL or anything other than "simple"), but I can't even get this simplest case working. Please help!!

Re: Simplest case of LDAP authentication doesn't work.. pls help

steffen — Fri, 20 Mar 2009 15:15:11 GMT

Hi,

try renaming the beans in the ldap-authentication-context.xml:

authenticationDaoLDAP to authenticationDao

and

authenticationComponentLDAP to authenticationComponent

HTH

steffen

—
Alfresco ECM solution engineer | ecm@dmc.de | http://www.dmc.de/ecm

Re: Simplest case of LDAP authentication doesn't work.. pls help

geoffrey1211 — Fri, 20 Mar 2009 19:57:48 GMT

thank you very much! it worked.

now, I wonder if I can use DIGEST-MD5 to get CIFS authenticated by AD as well?
CIFS needs MD4 or kerberos - does this mean DIGEST-MD5 is ok? I tried it, but it did not succeed:


15:53:07,740 User:System ERROR [smb.protocol.auth] No valid CIFS authentication combination available
15:53:07,740 User:System ERROR [smb.protocol.auth] Either enable Kerberos support or use an authentication component that supports MD4 hashed passwords
15:53:07,740 User:System ERROR [alfresco.smb.protocol] CIFS server configuration error, Invalid CIFS authenticator configuration
org.alfresco.error.AlfrescoRuntimeException: Invalid CIFS authenticator configuration
   at org.alfresco.filesys.auth.cifs.EnterpriseCifsAuthenticator.initialize(EnterpriseCifsAuthenticator.java:389)
   at org.alfresco.jlan.smb.server.CIFSConfigSection.setAuthenticator(CIFSConfigSection.java:607)
   at org.alfresco.filesys.ServerConfigurationBean.processCIFSServerConfig(ServerConfigurationBean.java:881)
   at org.alfresco.filesys.ServerConfigurationBean.init(ServerConfigurationBean.java:546)
   at org.alfresco.filesys.ServerConfigurationBean.onApplicationEvent(ServerConfigurationBean.java:3098)
   at org.springframework.context.event.SimpleApplicationEventMulticaster$1.run(SimpleApplicationEventMulticaster.java:77)
   at org.springframework.core.task.SyncTaskExecutor.execute(SyncTaskExecutor.java:49)
   at org.springframework.context.event.SimpleApplicationEventMulticaster.multicastEvent(SimpleApplicationEventMulticaster.java:75)
   at org.springframework.context.support.AbstractApplicationContext.publishEvent(AbstractApplicationContext.java:246)
   at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:355)
   at org.springframework.web.context.ContextLoader.createWebApplicationContext(ContextLoader.java:244)
   at org.springframework.web.context.ContextLoader.initWebApplicationContext(ContextLoader.java:187)
   at org.springframework.web.context.ContextLoaderListener.contextInitialized(ContextLoaderListener.java:49)
   at org.apache.catalina.core.StandardContext.listenerStart(StandardContext.java:3843)
   at org.apache.catalina.core.StandardContext.start(StandardContext.java:4342)
   at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:791)
   at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:771)
   at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:525)
   at org.apache.catalina.startup.HostConfig.deployWAR(HostConfig.java:830)
   at org.apache.catalina.startup.HostConfig.deployWARs(HostConfig.java:719)
   at org.apache.catalina.startup.HostConfig.deployApps(HostConfig.java:490)
   at org.apache.catalina.startup.HostConfig.start(HostConfig.java:1149)
   at org.apache.catalina.startup.HostConfig.lifecycleEvent(HostConfig.java:311)
   at org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(LifecycleSupport.java:117)
   at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1053)
   at org.apache.catalina.core.StandardHost.start(StandardHost.java:719)
   at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1045)
   at org.apache.catalina.core.StandardEngine.start(StandardEngine.java:443)
   at org.apache.catalina.core.StandardService.start(StandardService.java:516)
   at org.apache.catalina.core.StandardServer.start(StandardServer.java:710)
   at org.apache.catalina.startup.Catalina.start(Catalina.java:578)
   at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
   at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
   at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
   at java.lang.reflect.Method.invoke(Method.java:597)
   at org.apache.catalina.startup.Bootstrap.start(Bootstrap.java:288)
   at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:413)
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Or do we have to go through all the steps under "Configuring the Alfresco CIFS and web servers for Kerberos/Active
Directory integration" in the "Install_Configure_Alfresco_Lab3Stable.pdf" document? That's quite a lengthy process for something that seems so basic.

Can you tell me please?

Re: Simplest case of LDAP authentication doesn't work.. pls help

jottley — Sat, 21 Mar 2009 05:03:02 GMT

DIGEST-MD5 will work. You need to configure the filesystem to authenticate against AD. Add one of the following to your file-servers-custom.xml (updating the Server tag with your server.


 <config evaluator="string-compare" condition="CIFS Server">
          <!–The following defines the authentication connector to an AD server –>
          <authenticator type="passthru">
               <!– within the following tag place a comma delimited list of your AD servers that Alfresco should talk to–>
               <Server>192.168.20.10</Server>
          </authenticator>
     </config>
‍‍‍‍‍‍‍‍‍


<config evaluator="string-compare" condition="CIFS Server" replace="true">
          <serverEnable enabled="true"/>
          <host name="${localname}A" domain="WORKGROUP"/> 
          <!– The name attribute can use the special token of {localname} to use the local servers host name 
                and generate a unique name by prepending/appending to it. –>
          <comment>Alfresco CIFS Server</comment>

          <!– Set to the broadcast mask for the subnet –>
          <broadcast>255.255.255.255</broadcast>

          <!– Use Java socket based NetBIOS over TCP/IP and native SMB on linux –>
          <tcpipSMB platforms="linux,solaris,macosx"/> 
          <netBIOSSMB platforms="linux,solaris,macosx"/>

          <!– Use Win32 NetBIOS interface on Windows –>
          <Win32NetBIOS/>
          <Win32Announce interval="5"/>
          <hostAnnounce interval="5"/>

          <!–The following defines the authentication connector to an AD server –>
          <authenticator type="passthru">
               <!– within the following tag place a comma delimited list of your AD servers that Alfresco should talk to–>
               <Server>192.168.20.10</Server>
          </authenticator>

          <sessionDebug flags="Negotiate,Socket"/>
     </config> 
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Re: Simplest case of LDAP authentication doesn't work.. pls help

geoffrey1211 — Mon, 23 Mar 2009 18:01:22 GMT

What I did:
* added the code you suggested into file-servers-custom.xml
* configured my AD server to use "DIGEST-MD5 (SASL)" authentication
* changed ldap-authentication.properties to become like this:


ldap.authentication.userNameFormat=%s
ldap.authentication.java.naming.security.authentication=DIGEST-MD5
‍‍‍‍

What I observed after starting alfresco:
* no error in the log
* CIFS server is running (machinenameA shows with "nbtstat -n")
* login FAILED

My suspected culprits:
* "SASL Realm" on my AD server - currently left to blank. Don't know what to put here?
* the encryption method for the user entry's password on AD server - I should use DIGEST-MD5 right?

Any idea what could fix this?
Appreciate your help.

Re: Simplest case of LDAP authentication doesn't work.. pls help

lakshya — Thu, 02 Apr 2009 10:30:05 GMT

This can help you
Steps to follow for LDAP authentication in Alfresco:
Step 1:
Open
<Alfresco tomcat>\shared\classes\alfresco\extension\ ldap-authentication.properties

Change the following properties:
ldap.authentication.userNameFormat=%s@abc.co.in

# The URL to connect to the LDAP server
ldap.authentication.java.naming.provider.url=ldap://ptdc.abc.co.in:389

# The authentication mechanism to use
ldap.authentication.java.naming.security.authentication=SIMPLE

# The default principal to use (only used for LDAP sync)
#ldap.authentication.java.naming.security.principal=<userid>

# The password for the default principal (only used for LDAP sync)
#ldap.authentication.java.naming.security.credentials=<password>

# Escape commas entered by the user at bind time
# Useful when using simple authentication and the CN is part of the DN and contains commas
ldap.authentication.escapeCommasInBind=false

# Escape commas entered by the user when setting the authenticated user
# Useful when using simple authentication and the CN is part of the DN and contains commas, and the escaped \, is
# pulled in as part of an LDAP sync
# If this option is set to true it will break the default home folder provider as space names can not contain \
ldap.authentication.escapeCommasInUid=false

Step 2:
Rename file ldap-authentication-context.xml.sample to ldap-authentication-context.xml

Step 3:
Restart the server and login with persistent domain credentials. No need to give domain name.

Step 4:
Set User as admin
Open
<Alfresco tomcat>\webapps\alfresco\WEB-INF\classes\alfresco\authority-services-context.xml

and change the value of user adminUsers from admin. In our case, we have replaced ‘admin’ with ‘laxmi_tidke’.

Example:
<property name="adminUsers">
            <set>
             <value>laxmi_tidke</value>
             <value>administrator</value>
          </set>
        </property>

Re: Simplest case of LDAP authentication doesn't work.. pls help

geoffrey1211 — Thu, 09 Apr 2009 14:28:18 GMT

thanks for your reply. I however figured out that the "uid" attribute is required on the AD server in order for this DIGEST-MD5 to work - SASL Realm is not necessary at all.

Re: Simplest case of LDAP authentication doesn't work.. pls help

naveenalfresco — Wed, 15 Apr 2009 09:13:57 GMT

:cry: Anyone pls help me. Its urgent

I am not able to set the LDAP and Alfresco properly since 4 days. I am getting the following error


WARN  [org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl] LDAP server supports anonymous bind ldap://172.22.3.134:389
INFO  [org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl] LDAP server does not support simple string user ids and invalid credentials at ldap://172.22.3.134:389
INFO  [org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl] LDAP server does not fall back to anonymous bind for a simple dn and password at ldap://172.22.3.134:389
INFO  [org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl] LDAP server does not fall back to anonymous bind for known principal and invalid credentials at ldap://172.22.3.134:389
‍‍‍‍‍‍

My configurations files are as below

ldap-authentication.properties


ldap.authentication.userNameFormat=cn=%s,ou=people,dc=someco,dc=com 
ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory
ldap.authentication.java.naming.provider.url=ldap://172.22.3.134:389
ldap.authentication.java.naming.security.authentication=simple
ldap.authentication.java.naming.security.principal=cn=Manager,dc=someco,dc=com
ldap.authentication.java.naming.security.credentials=secret
ldap.authentication.escapeCommasInBind=false
ldap.authentication.escapeCommasInUid=false
‍‍‍‍‍‍‍‍‍‍

ldap-authentication-context.xml


<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE beans PUBLIC '-//SPRING//DTD BEAN//EN' 'http://www.springframework.org/dtd/spring-beans.dtd'>

<beans>
    
   <!– The main configuration has moved into a properties file –>
    
    <bean name="ldapAuthenticationPlaceholderConfigurer" class="org.springframework.beans.factory.config.PropertyPlaceholderConfigurer">
        <property name="ignoreUnresolvablePlaceholders">
            <value>true</value>
        </property>  
        <property name="locations">
            <value>classpath:alfresco/extension/ldap-authentication.properties</value>
        </property>
    </bean>
    
    <!– DAO that rejects changes - LDAP is read only at the moment. It does allow users to be deleted with out warnings from the UI. –>
    
    <bean name="authenticationDaoLDAP" class="org.alfresco.repo.security.authentication.DefaultMutableAuthenticationDao" >
        <property name="allowDeleteUser">
            <value>true</value>
        </property>
    </bean>    
   
    <!– LDAP authentication configuration –>
    <!– 
    You can also use JAAS authentication for Kerberos against Active Directory or NTLM if you also require single sign on from the
    web browser. You do not have to use LDAP authentication to synchronise groups and users from an LDAP store if it supports other
    authentication routes, like Active Directory.
    –>
    <bean id="authenticationComponentImplLDAP"
          class="org.alfresco.repo.security.authentication.ldap.LDAPAuthenticationComponentImpl" 
          parent="authenticationComponentBase">
        <property name="LDAPInitialDirContextFactory">
            <ref bean="ldapInitialDirContextFactory"/>
        </property>
        <property name="userNameFormat">
            <!–
            This maps between what the user types in and what is passed through to the underlying LDAP authentication.
            
            "%s" - the user id is passed through without modification.
            Used for LDAP authentication such as DIGEST-MD5, anything that is not "simple".
            
            "cn=%s,ou=London,dc=company,dc=com" - If the user types in "Joe Bloggs" the authenticate as "cn=Joe Bloggs,ou=London,dc=company,dc=com" 
            Usually for simple authentication. Simple authentication always uses the DN for the user.
         –>
         
            <value>${ldap.authentication.userNameFormat}</value>
        </property>
        <property name="nodeService">
            <ref bean="nodeService" />
        </property>
        <property name="personService">
            <ref bean="personService" />
        </property>
        <property name="transactionService">
            <ref bean="transactionService" />
        </property>   
        <property name="escapeCommasInBind">
            <value>${ldap.authentication.escapeCommasInBind}</value>
        </property>
        <property name="escapeCommasInUid">
            <value>${ldap.authentication.escapeCommasInUid}</value>
        </property> 
    </bean>
   
    <!–
    This bean is used to support general LDAP authentication. It is also used to provide read only access to users and groups
    to pull them out of the LDAP reopsitory
    –>
    
    <bean id="ldapInitialDirContextFactory" class="org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl">
        <property name="initialDirContextEnvironment">
            <map>
                <!– The LDAP provider –>
                <entry key="java.naming.factory.initial">
                    <value>${ldap.authentication.java.naming.factory.initial}</value>
                </entry>
                
                <!– The url to the LDAP server –>
                <!– Note you can use space separated urls - they will be tried in turn until one works –>
                <!– This could be used to authenticate against one or more ldap servers (you will not know which one ….) –>
                <entry key="java.naming.provider.url">
                    <value>${ldap.authentication.java.naming.provider.url}</value>
                </entry>
                
                <!– The authentication mechanism to use      –>
                <!– Some sasl authentication mechanisms may require a realm to be set –>
                <!–                java.naming.security.sasl.realm –>
                <!– The available options will depend on your LDAP provider –>
                <entry key="java.naming.security.authentication">
                    <value>${ldap.authentication.java.naming.security.authentication}</value>
                </entry>
                
                <!– The id of a user who can read group and user information –>
                <!– This does not go through the pattern substitution defined above and is used "as is" –>
                <entry key="java.naming.security.principal">
                    <value>${ldap.authentication.java.naming.security.principal}</value>
                </entry>
                
                <!– The password for the user defined above –>
                <entry key="java.naming.security.credentials">
                    <value>${ldap.authentication.java.naming.security.credentials}</value>
                </entry>
            </map>
        </property>
    </bean>
    
</beans>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

chaining-authentication-context.xml


<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE beans PUBLIC '-//SPRING//DTD BEAN//EN' 'http://www.springframework.org/dtd/spring-beans.dtd'>

<beans>

    <!– Chaining –>
    <bean id="authenticationServiceImpl" class="org.alfresco.repo.security.authentication.ChainingAuthenticationServiceImpl">
        <property name="authenticationServices">
            <list>
                <ref bean="authenticationServiceImplLDAP"/>
            </list>
        </property>
        <property name="mutableAuthenticationService">
            <ref bean="authenticationServiceImplAlfresco"/>
        </property>
    </bean>

    <!– Alfresco Auth –>
    <bean id="authenticationServiceImplAlfresco" class="org.alfresco.repo.security.authentication.AuthenticationServiceImpl">
        <property name="authenticationDao">
            <ref bean="authenticationDaoAlfresco"/>
        </property>
        <property name="ticketComponent">
            <ref bean="ticketComponent"/>
        </property>
        <property name="authenticationComponent">
            <ref bean="authenticationComponentImplAlfresco"/>
        </property> 
    </bean>
         
    <bean id="authenticationDaoAlfresco" class="org.alfresco.repo.security.authentication.RepositoryAuthenticationDao">
        <property name="nodeService">
            <ref bean="nodeService"/>
        </property>
        <property name="dictionaryService"> 
            <ref bean="dictionaryService"/>
        </property>
        <property name="namespaceService">
            <ref bean="namespaceService"/>
        </property> 
        <property name="searchService"> 
            <ref bean="searchService"/>
        </property> 
        <property name="userNamesAreCaseSensitive">
            <value>${user.name.caseSensitive}</value>
        </property>
        <property name="passwordEncoder">
            <ref bean="passwordEncoder"/>
        </property>
    </bean>

    <bean id="authenticationComponentImplAlfresco" class="org.alfresco.repo.security.authentication.AuthenticationComponentImpl">
        <property name="authenticationDao">
            <ref bean="authenticationDaoAlfresco"/>
        </property>
        <property name="authenticationManager">
            <ref bean="authenticationManager"/>
        </property>
        <property name="allowGuestLogin">
            <value>true</value>
        </property>
    </bean>

   <!– LDAP Auth –>
    <bean id="authenticationServiceImplLDAP" class="org.alfresco.repo.security.authentication.AuthenticationServiceImpl">
        <property name="authenticationDao">
            <ref bean="authenticationDaoLDAP" />
        </property>
        <property name="ticketComponent">
            <ref bean="ticketComponent" />
        </property>
        <property name="authenticationComponent">
            <ref bean="authenticationComponentImplLDAP" />
        </property>
    </bean>

    <bean id="authenticationComponentImplLDAP" class="org.alfresco.repo.security.authentication.ldap.LDAPAuthenticationComponentImpl">
        <property name="LDAPInitialDirContextFactory">
            <ref bean="ldapInitialDirContextFactory"/>
        </property>
        <property name="userNameFormat">
            <value>cn=%s,ou=people,dc=someco,dc=com</value>
        </property>
    </bean>

    <bean id="authenticationDaoLDAP" class="org.alfresco.repo.security.authentication.ntlm.NullMutableAuthenticationDao"/>

</beans>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Can any one pls help me to configure the LDAP with Alfresco.
Advance Thanks