topic Alfresco Integration with OpenSSO in Alfresco Archive

Alfresco Integration with OpenSSO

daxter123 — Wed, 22 Apr 2009 00:15:58 GMT

HI,How i can integrate alfresco with open sso?Thanks

Re: Alfresco Integration with OpenSSO

g_fernandes — Wed, 22 Apr 2009 09:04:30 GMT

We at Sourcesense (http://www.sourcesense.com) are maintainers of an opensource project that integrates Alfresco and OpenSSO.

Please check the quick start guide at https://dev.sourcesense.com/svn/alfresco/sso/opensso/tags/alfresco-opensso-0.5/README

Feedbacks and contributions will be most welcome!

Regards,

–
Gustavo Nalle Fernandes
g.fernandes at sourcesense.com

Re: Alfresco Integration with OpenSSO

daxter123 — Wed, 22 Apr 2009 17:37:30 GMT

Thanks fernands
This is a great effort.

Re: Alfresco Integration with OpenSSO

techian — Wed, 22 Apr 2009 20:26:33 GMT

I followed the readme, however on first access to Alfresco I get a

java.lang.NoClassDefFoundError: Could not initialize class com.iplanet.services.naming.service.NamingService

and on refreshing the page I get another exception

java.lang.NoClassDefFoundError: Could not initialize class com.iplanet.dpro.session.Session

NamingService is not present in the opensso client jar file but the Session class is present in it. Any ideas what might be causing this or which jar files need to be included for the NamingService class?

Also I wasn't sure which AMConfig.properties file needs to be edited. I found one in in <webapps>/opensso/WEB-INF/classes/AMConfig.properties but that did not have a property corresponding to Opensso server home directory

Re: Alfresco Integration with OpenSSO

g_fernandes — Wed, 22 Apr 2009 21:54:34 GMT

Hello,

In the Alfresco side, your have to copy three files:

../WEB-INF/lib:
- openssoclientsdk-8.0.jar
- alfresco-opensso-0.5.jar

../WEB-INF/classes:
- AMConfig.properties

An example of AMConfig can be taken from:

https://dev.sourcesense.com/svn/alfresco/sso/opensso/tags/alfresco-opensso-0.5/src/test/resources/AMConfig.properties

You have to change the IP, port, and password to reflect your OpenSSO server. Also, in alfresco web.xml, pay attention to the filter property "opensso.url", that must point to the OpenSSO web application.

No changes are required to OpenSSO web application files since this is a client deployment that will are doing.

–
Gustavo Nalle Fernandes
g.fernandes at sourcesense.com

Re: Alfresco Integration with OpenSSO

daxter123 — Thu, 23 Apr 2009 04:17:33 GMT

com.sun.identity.agents.app.username=UrlAccessAgent
com.iplanet.am.service.password=123456789

Fernandes can you please tell me which user and password should be given for these properties and what is the usages of this?

Thanks

Re: Alfresco Integration with OpenSSO

g_fernandes — Thu, 23 Apr 2009 09:11:13 GMT

Sure!

The com.sun.identity.agents.app.username and com.iplanet.am.service.password are the credentials of the Default Policy agent. They're used by the opensso client to read OpenSSO data remotely.

http://docs.sun.com/app/docs/doc/820-3748/gfwtp?l=en&a=view

The username "UrlAccessAgent" is suggested by OpenSSO in the moment of the installation, the same time where you must choose a password

Please note that you can specify an encrypted password by using the property com.iplanet.am.service.secret instead of com.iplanet.am.service.password.

For a complete reference of the AMConfig.properties in the client side, please see:

http://docs.sun.com/app/docs/doc/820-3748/gifak?l=en&a=view

Regards,

–
Gustavo Nalle Fernandes
g.fernandes at sourcesense.com

Re: Alfresco Integration with OpenSSO

daxter123 — Thu, 23 Apr 2009 16:58:20 GMT

Thanks a lot Fernandes. It was really helpful for me.

Re: Alfresco Integration with OpenSSO

techian — Thu, 23 Apr 2009 21:10:44 GMT

Thanks for the pointer on the AMConfig.properties.

I had more errors with this AMConfig.properties and the exception specifically said that I need to check the username and password in AMConfig. As it turns out this exception message is less than helpful. Enabling debug message in AMConfig.properties finally pointed me in the right direction.

In my case, I had tomcat running alfresco and opensso as a non root user in port 8080 and an iptables rule to route connections to the box on 8080 to port 80. The client was using http://localhost:80/opensso to do its SSO token creation and validation and was getting connection refused errors. So I had to add another iptables rule to make the 80->8080 port forwarding within localhost.

Re: Alfresco Integration with OpenSSO

techian — Thu, 23 Apr 2009 21:41:03 GMT

Fernandes,

Is there any plan to support Alfresco Share web application and CIFS authentication through OpenSSO?

Re: Alfresco Integration with OpenSSO

techian — Fri, 24 Apr 2009 00:13:59 GMT

I poked around a bit and found that you have a folder called share in svn. I checked that out and built and deployed it in the Alfresco Share web application. I used the web.xml from the svn. I placed the AMConfig.properties in <webapps>\share\WEB-INF\classes and custom-web-context.xml in <tomcat>\shared\classes\alfresco\extension. I also had to place the jar file I built in the <webapps>\alfresco\WEB-INF\lib folder

On first access to Alfresco Share, I get redirected to Open SSO login. However after a successful login there, I get redirected back to Alfresco Share's login page.

Did I miss any step in setting up Alfresco Share to do OpenSSO authentication?

Re: Alfresco Integration with OpenSSO

g_fernandes — Fri, 24 Apr 2009 19:09:55 GMT

Hi,

Please refer to http://opensource.sourcesense.com/confluence/display/ALE/version+0.6 to integrate Share and webscripts in general with OpenSSO. CIFS is not yet supported in this version, but will be shortly!

Regards,

–
Gustavo Nalle Fernandes
g.fernandes at sourcesense.com

Re: Alfresco Integration with OpenSSO

techian — Fri, 24 Apr 2009 20:13:13 GMT

This works great! Thanks for sharing it with the community.
I did notice that logout from Share does not work unlike logout from Alfresco. I suppose the cookie needs to be cleared by redirecting to the Opensso login URL.

Re: Alfresco Integration with OpenSSO

g_fernandes — Wed, 29 Apr 2009 13:20:32 GMT

You're welcome!

The Share's logout is not yet implemented in version 0.6, it'll be included in the next version, to be released very shortly. Please refer to http://opensource.sourcesense.com/jira/browse/ALFOSSO-1.

Thanks,
–
Gustavo Nalle Fernandes
g.fernandes at sourcesense.com

Re: Alfresco Integration with OpenSSO

techian — Thu, 30 Apr 2009 21:49:38 GMT

I somehow managed to break the OpenSSO integration with Alfresco when moving to a new Server. I downloaded the latest Alfresco 3.1 Labs release with Tomcat bundle and added the Sourcesense OpenSSO filter as described in this HOWTO http://opensource.sourcesense.com/confluence/display/ALE/version+0.6.

However, after a successful redirect and login from OpenSSO to Alfresco, the new user is not created and the Login(guest) link remains as it is. Likewise, when I try to login to Share, it results in an infinite redirect loop. When I looked up this infinite redirect loop, most solutions point to enabling cookie encoding in OpenSSO to overcome a Tomcat issue http://docs.sun.com/app/docs/doc/820-3320/ggwyv?a=view. This did not solve the login problem, but it did get rid of an extra Warning message I was seeing in catalina.out

WARNING: Parameters: Invalid chunk ignored‍

.
I tried a few different options including adding the following to AMConfig.properties

com.iplanet.am.serverMode=false
com.iplanet.am.cookie.encode=true
com.iplanet.am.cookie.secure=false
‍‍‍‍

But that did not work either. I wonder if at the client level you have to decode the parameters before building the token.

Here is the trace I'm seeing in catalina.out


amNaming:04/30/2009 02:14:53:846 PM PDT: Thread[http-8080-1,5,main]
ERROR: WebtopNaming.getServerId():noServerId
amNaming:04/30/2009 02:14:53:884 PM PDT: Thread[http-8080-1,5,main]
ERROR: WebtopNaming.getServerId()
java.lang.Exception: Cannot find server ID.
   at com.iplanet.services.naming.WebtopNaming.getServerID(WebtopNaming.java:626)
   at com.iplanet.services.naming.WebtopNaming.getServerID(WebtopNaming.java:590)
   at com.iplanet.services.naming.WebtopNaming.getAMServerID(WebtopNaming.java:226)
   at com.iplanet.dpro.session.Session.<clinit>(Session.java:311)
   at com.iplanet.sso.providers.dpro.SSOProviderImpl.createSSOToken(SSOProviderImpl.java:88)
   at com.iplanet.sso.SSOTokenManager.createSSOToken(SSOTokenManager.java:239)
   at com.sourcesense.alfresco.opensso.OpenSSOClient.createTokenFrom(OpenSSOClient.java:79)
   at com.sourcesense.alfresco.webscript.OpenSSOAuthenticationFactory$OpenSSOAuthenticator.authenticate(OpenSSOAuthenticationFactory.java:91)
   at org.alfresco.repo.web.scripts.RepositoryContainer.executeScript(RepositoryContainer.java:265)
   at org.alfresco.web.scripts.AbstractRuntime.executeScript(AbstractRuntime.java:261)
   at org.alfresco.web.scripts.AbstractRuntime.executeScript(AbstractRuntime.java:139)
   at org.alfresco.web.scripts.servlet.WebScriptServlet.service(WebScriptServlet.java:116)
   at javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
   at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
   at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
   at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
   at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
   at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128)
   at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
   at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
   at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:286)
   at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:845)
   at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:583)
   at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:447)
   at java.lang.Thread.run(Thread.java:619)

amSSOProvider:04/30/2009 02:14:53:988 PM PDT: Thread[http-8080-1,5,main]
could not create SSOToken from HttpRequest
com.iplanet.dpro.session.SessionException: Invalid session ID.
   at com.iplanet.dpro.session.Session.getSession(Session.java:970)
   at com.iplanet.sso.providers.dpro.SSOProviderImpl.createSSOToken(SSOProviderImpl.java:88)
   at com.iplanet.sso.SSOTokenManager.createSSOToken(SSOTokenManager.java:239)
   at com.sourcesense.alfresco.opensso.OpenSSOClient.createTokenFrom(OpenSSOClient.java:79)
   at com.sourcesense.alfresco.webscript.OpenSSOAuthenticationFactory$OpenSSOAuthenticator.authenticate(OpenSSOAuthenticationFactory.java:91)
   at org.alfresco.repo.web.scripts.RepositoryContainer.executeScript(RepositoryContainer.java:265)
   at org.alfresco.web.scripts.AbstractRuntime.executeScript(AbstractRuntime.java:261)
   at org.alfresco.web.scripts.AbstractRuntime.executeScript(AbstractRuntime.java:139)
   at org.alfresco.web.scripts.servlet.WebScriptServlet.service(WebScriptServlet.java:116)
   at javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
   at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
   at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
   at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
   at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
   at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128)
   at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
   at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
   at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:286)
   at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:845)
   at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:583)
   at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:447)
   at java.lang.Thread.run(Thread.java:619)
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

I have noticed that opensso has a number of undocumented gotchas - For instance, the configurator does not like it when I deploy OpenSSO with the / context path and throws a string index out of range exception. Maybe I've run into one such weirdness.

Re: Alfresco Integration with OpenSSO

g_fernandes — Fri, 01 May 2009 14:45:10 GMT

Hi, some things to check:

1) You said you moved OpenSSO to a new server. Is this new server accessible under the same domain (or a subdomain) of the Alfresco server?
2) What's the value of your property com.iplanet.am.naming.url at <Alfresco_Home>/tomcat/shared/classes? Can you access that URL in the browser from the Alfresco machine?
3) What is the version of your tomcat that runs OpenSSO? Version 6.0.18 is recommended

Regards,
–
Gustavo Nalle Fernandes
g.fernandes at sourcesense.com

Re: Alfresco Integration with OpenSSO

techian — Sat, 02 May 2009 01:17:22 GMT

The OpenSSO server and the Alfresco server are in the same domain.
The naming URL is accessible from the Alfresco machine
I used the Tomcat version bundled with Alfresco 3.1 which happens to be 6.0.18.

That being said, I finally got it working.

I moved the AMConfig.properties and the openssosdk-8.0 jar file to the individual webapps (alfresco and share) WEB-INF directory instead of the tomcat container level directories as listed in the HOWTO and everything seems to be working now! I'm not sure why this would be the case, but since its working, I'm moving on for now.

Also, for integration with Liferay Portal, I had to set the com.iplanet.am.cookie.encode=true both on the Alfresco side AMConfig.properties and in the OpenSSO server (using their console)

com.iplanet.am.cookie.encode=true‍

. I think setting this property in all cases is probably a good idea.

Re: Alfresco Integration with OpenSSO

javid — Thu, 14 May 2009 08:38:00 GMT

plz can any of u tell wat might be causing this
com.iplanet.dpro.session.SessionException: Service URL not found
can u tell me wherein i hav to specify the service url in alfresco plz reply asap thanks in advance

Re: Alfresco Integration with OpenSSO

g_fernandes — Thu, 14 May 2009 12:52:06 GMT

There are two properties related to OpenSSO that your must set, as of version 0.6 http://opensource.sourcesense.com/confluence/display/ALE/version+0.6 of the filter.
In the web.xml goes the url and port of your opensso server. In AMConfig.properties goes the naming URL of the opensso
(property com.iplanet.am.naming.url). To be sure the values are correct, try to open them in the browser.

Regards,
–
Gustavo Nalle Fernandes
g.fernandes at sourcesense.com

Re: Alfresco Integration with OpenSSO

myj — Sat, 11 Jul 2009 01:06:09 GMT

I tried essentially the same thing as you described except I am using alfresco-opennso v 0.7 and tomcat 5.5.27, and no luck. No liferay involved, just alfresco and opensso.

Posted details at http://opensource.sourcesense.com/confluence/display/ALE/version+0.6

Any other pointers.

The OpenSSO server and the Alfresco server are in the same domain.
The naming URL is accessible from the Alfresco machine
I used the Tomcat version bundled with Alfresco 3.1 which happens to be 6.0.18.

That being said, I finally got it working.

I moved the AMConfig.properties and the openssosdk-8.0 jar file to the individual webapps (alfresco and share) WEB-INF directory instead of the tomcat container level directories as listed in the HOWTO and everything seems to be working now! I'm not sure why this would be the case, but since its working, I'm moving on for now.

Also, for integration with Liferay Portal, I had to set the com.iplanet.am.cookie.encode=true both on the Alfresco side AMConfig.properties and in the OpenSSO server (using their console)
com.iplanet.am.cookie.encode=true‍
. I think setting this property in all cases is probably a good idea.