topic Kerberos SSO + Active Directory in Alfresco Archive https://connect.hyland.com/t5/alfresco-archive/kerberos-sso-active-directory/m-p/185368#M138498 <HTML><HEAD></HEAD><BODY><SPAN>Hola comunidad,</SPAN><BR /><BR /><SPAN>Quiero acceder a Share automaticamente por Kerberos SSO con los usuarios de mi dominio pero no le encuentro la vuelta. Puedo acceder a Alfresco sin problemas, pero no a share. Al final pueden ver los logs.</SPAN><BR /><BR /><SPAN>Servidores: Todos pegados al dominio MIDOMINIO.NET</SPAN><BR /><SPAN>* w2008alfresco - (Alfresco) Windows Server 2008 R2</SPAN><BR /><SPAN>* AD01 - (Active Directory) Windows Server 2008 R2</SPAN><BR /><SPAN>* clientexp - (Maquina cliente) - Windows XP SP3 / Internet Explorer 6 / Firefox 28</SPAN><BR /><SPAN>* cliente01 (Maquina cliente) - Windows 7 / Internet Explorer 11 / Firefox 28</SPAN><BR /><BR /><BR /><SPAN>1) En active directory AD01 cree el usuario 'alfrescohttp'</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; - No requere autenticacion Kerberos previa</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; - La contraseña No caduca</SPAN><BR /><BR /><SPAN>2) En active directory&nbsp; AD01 ejecute</SPAN><BR /><BR /><PRE class="language-none line-numbers"><CODE>ktpass -princ HTTP/w2008alfresco.midominio.net@MIDOMINIO.NET -pass MIPASSWORD -mapuser midominio\alfrescohttp -crypto RC4-HMAC-NT -ptype KRB5_NT_PRINCIPAL -out c:\temp\alfrescohttp.keytab -kvno 0<SPAN class="line-numbers-rows"><SPAN>‍</SPAN></SPAN></CODE></PRE><BR /><BR /><SPAN>3) Copiar keytab a maquina alfresco (w2008alfresco)</SPAN><BR /><BR /><SPAN>4) Crear servicios en AD01</SPAN><BR /><PRE class="language-none line-numbers"><CODE> <BR />setspn -a HTTP/W2008ALFRESCO alfrescohttp<BR />setspn -a HTTP/W2008ALFRESCO.midominio.net alfrescohttp<BR /><SPAN class="line-numbers-rows"><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN></SPAN></CODE></PRE><BR /><BR /><SPAN>5) Configurar C:\Windows\krb5.ini (De servidor w2008alfresco)</SPAN><BR /><PRE class="language-none line-numbers"><CODE><BR />[libdefaults]<BR />default_realm = MIDOMINIO.NET<BR />default_tkt_enctypes = rc4-hmac<BR />default_tgs_enctypes = rc4-hmac<BR /><BR />[realms]<BR />MIDOMINIO.NET = {<BR />&nbsp;&nbsp; kdc = ad01.midominio.net<BR />&nbsp;&nbsp; admin_server = ad01.midominio.net<BR />}<BR /><BR />[domain_realm]<BR />ad01.midominio.net = MIDOMINIO.NET<BR />.ad01.midominio.net = MIDOMINIO.NET<BR /><SPAN class="line-numbers-rows"><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN></SPAN></CODE></PRE><BR /><BR /><SPAN>6) Crear java.login.config en C:/Alfresco/java/jre/lib/security (maquina w2008alfresco)</SPAN><BR /><BR /><PRE class="language-none line-numbers"><CODE><BR />Alfresco {<BR />&nbsp;&nbsp; com.sun.security.auth.module.Krb5LoginModule sufficient;<BR />};<BR /><BR />AlfrescoHTTP<BR />{<BR />&nbsp;&nbsp; com.sun.security.auth.module.Krb5LoginModule required<BR />&nbsp;&nbsp; storeKey=true<BR />&nbsp;&nbsp; useKeyTab=true<BR />&nbsp;&nbsp; keyTab="C:/Alfresco/keytab/alfrescohttp.keytab"<BR />&nbsp;&nbsp; principal="HTTP/W2008ALFRESCO.midominio.net";<BR />};<BR /><BR />ShareHTTP<BR />{<BR />&nbsp;&nbsp; com.sun.security.auth.module.Krb5LoginModule required<BR />&nbsp;&nbsp; storeKey=true<BR />&nbsp;&nbsp; useKeyTab=true<BR />&nbsp;&nbsp; keyTab="C:/Alfresco/keytab/alfrescohttp.keytab"<BR />&nbsp;&nbsp; principal="HTTP/W2008ALFRESCO.midominio.net";<BR />};<BR /><BR />com.sun.net.ssl.client {<BR />&nbsp;&nbsp; com.sun.security.auth.module.Krb5LoginModule sufficient;<BR />};<BR /><BR />other {<BR />&nbsp;&nbsp; com.sun.security.auth.module.Krb5LoginModule sufficient;<BR />};<BR /><SPAN class="line-numbers-rows"><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN></SPAN></CODE></PRE><BR /><BR /><SPAN>7) Apuntar clase de login en C:/Alfresco/java/jre/lib/security/java.security (Maquina w2008alfresco)</SPAN><BR /><PRE class="language-none line-numbers"><CODE><BR />login.config.url.1=file:C:/Alfresco/java/jre/lib/security/java.login.config<BR /><SPAN class="line-numbers-rows"><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN></SPAN></CODE></PRE><BR /><BR /><SPAN>Agregue los sitios </SPAN><A href="http://w2008alfresco" rel="nofollow noopener noreferrer">http://w2008alfresco</A><SPAN> y </SPAN><A href="http://w2008alfresco.midominio.net" rel="nofollow noopener noreferrer">http://w2008alfresco.midominio.net</A><SPAN> en internet explorer en la intranet de las maquinas cliente. Ademas en las opciones marque "Iniciar Sesion automatico con nombre de usuario y contraseña".</SPAN><BR /><BR /><SPAN><span class="lia-unicode-emoji" title=":smiling_face_with_sunglasses:">😎</span> Renombre el archivo share-config-custom.xml.sample a share-config-custom.xml</SPAN><BR /><BR /><SPAN>9) Descomente las dos sessiones Remote</SPAN><BR /><BR /><SPAN>10) Reemplace KerberosDisables por Kerberos con los siguientes datos</SPAN><BR /><BR /><PRE class="language-none line-numbers"><CODE><BR />&lt;config evaluator="string-compare" condition="Kerberos" replace="true"&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;kerberos&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;password&gt;MIPASSWORD&lt;/password&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;realm&gt;MIDOMINIO.NET&lt;/realm&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;endpoint-spn&gt;HTTP/w2008ALFRESCO.midominio.net@MIDOMINIO.NET&lt;/endpoint-spn&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;config-entry&gt;ShareHTTP&lt;/config-entry&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;/kerberos&gt;<BR />&nbsp;&nbsp; &lt;/config&gt;<BR /><SPAN class="line-numbers-rows"><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN></SPAN></CODE></PRE><BR /><BR /><SPAN>11) En active directory, en el usuario alfrescohttop en la pestaña de delegacion marque "Trust this user for delegation to any service (Kerberos only)"</SPAN><BR /><BR /><SPAN>12) En firefox modifique las configuraciones</SPAN><BR /><PRE class="language-none line-numbers"><CODE>network.negotiate-auth.delegation-uris<BR />network.negotiate-auth.trusted-uris<BR />network.negotiate-auth.using-native-gsslib<SPAN class="line-numbers-rows"><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN></SPAN></CODE></PRE><BR /><BR /><SPAN>13) alfresco.properties</SPAN><BR /><PRE class="language-none line-numbers"><CODE><BR />authentication.chain=kerberos1:kerberos,alfrescoNtlm1:alfrescoNtlm<BR /><BR />kerberos.authentication.realm=MIDOMINIO.NET<BR />kerberos.authentication.sso.enabled=true<BR /><BR />kerberos.authentication.authenticateCIFS=false<BR />kerberos.authentication.user.configEntryName=Alfresco<BR />kerberos.authentication.http.configEntryName=AlfrescoHTTP<BR />kerberos.authentication.http.password=MIPASSWORD<BR />kerberos.authentication.defaultAdministratorUserNames=admin<BR />kerberos.authentication.stripUsernameSuffix=true<BR /><SPAN class="line-numbers-rows"><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN></SPAN></CODE></PRE><BR /><BR /><SPAN>logs. Cuando quiero acceder</SPAN><BR /><BR /><PRE class="language-none line-numbers"><CODE><BR /> Search Subject for Kerberos V5 ACCEPT cred (HTTP/W2008ALFRESCO.midominio.net@MIDOMINIO.NET, sun.security.jgss.krb5.Krb5AcceptCredential)<BR />Found KeyTab<BR />Found KerberosKey for HTTP/W2008ALFRESCO.midominio.net@MIDOMINIO.NET<BR />Entered Krb5Context.acceptSecContext with state=STATE_NEW<BR />Added key: 23version: 0<BR />Ordering keys wrt default_tkt_enctypes list<BR />default etypes for default_tkt_enctypes: 23.<BR />&gt;&gt;&gt; EType: sun.security.krb5.internal.crypto.ArcFourHmacEType<BR />Using builtin default etypes for permitted_enctypes<BR />default etypes for permitted_enctypes: 17 16 23 1 3.<BR />&gt;&gt;&gt; EType: sun.security.krb5.internal.crypto.ArcFourHmacEType<BR />System time adjusted<BR />object 0: 1398444344146/146721<BR />replay cache found.<BR />&gt;&gt;&gt; KrbApReq: authenticate succeed.<BR />Krb5Context setting peerSeqNumber to: 1290115219<BR />&gt;&gt;&gt; EType: sun.security.krb5.internal.crypto.ArcFourHmacEType<BR />Krb5Context setting mySeqNumber to: 75067258<BR />2014-04-25 13:45:44,053&nbsp; WARN&nbsp; [site.servlet.KerberosSessionSetupPrivilegedAction] [http-apr-8080-exec-9] credentials can not be delegated!<BR /><SPAN class="line-numbers-rows"><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN></SPAN></CODE></PRE><BR /></BODY></HTML> Fri, 25 Apr 2014 16:54:09 GMT emelbye 2014-04-25T16:54:09Z Kerberos SSO + Active Directory https://connect.hyland.com/t5/alfresco-archive/kerberos-sso-active-directory/m-p/185368#M138498 Hola comunidad,Quiero acceder a Share automaticamente por Kerberos SSO con los usuarios de mi dominio pero no le encuentro la vuelta. Puedo acceder a Alfresco sin problemas, pero no a share. Al final pueden ver los logs.Servidores: Todos pegados al dominio MIDOMINIO.NET* w2008alfresco - (Alfresco) W Fri, 25 Apr 2014 16:54:09 GMT https://connect.hyland.com/t5/alfresco-archive/kerberos-sso-active-directory/m-p/185368#M138498 emelbye 2014-04-25T16:54:09Z Re: Kerberos SSO + Active Directory https://connect.hyland.com/t5/alfresco-archive/kerberos-sso-active-directory/m-p/185369#M138499 <HTML><HEAD></HEAD><BODY><SPAN>Hola,</SPAN><BR /><BR /><SPAN>Entiendo que requieras una customización de Alfresco Share para que Single Sign On funcione correctamente.</SPAN><BR /><BR /><SPAN>Revisaste esto?</SPAN><BR /><BR /><A href="http://docs.alfresco.com/4.2/tasks/auth-kerberos-shareSSO.html" rel="nofollow noopener noreferrer">http://docs.alfresco.com/4.2/tasks/auth-kerberos-shareSSO.html</A><BR /><BR /><SPAN>Saludos.</SPAN></BODY></HTML> Mon, 20 Oct 2014 04:40:25 GMT https://connect.hyland.com/t5/alfresco-archive/kerberos-sso-active-directory/m-p/185369#M138499 jonvargas 2014-10-20T04:40:25Z