Kerberos auth on HEAD

chapeaurouge — Fri, 23 Jan 2009 16:37:21 GMT

Hello all,It's been several days I am trying to make kerberos authentication work (against AD running on Win2003 R2), both with the regular 3.0 labs and now the SVN version (rev 12844). The server running alfresco is a gentoo 64bits (xen virtualized), tomcat is tomcat-6.0.18.Kerberos seems to work f

Re: Kerberos auth on HEAD

chapeaurouge — Fri, 13 Feb 2009 11:33:06 GMT

I got it working for the web and webdav ok.

No luck for CIFS, but this seems to be a topic coming up quite often. I haven't seen any clear solution to that. Is there actually one?

Re: Kerberos auth on HEAD

rogier_oudshoor — Mon, 16 Feb 2009 08:11:20 GMT

Could you share your CIFS configuration section from the file-servers-custom.xml of file-servers.xml? That would help us greatly in spotting issues

Re: Kerberos auth on HEAD

chapeaurouge — Mon, 16 Feb 2009 10:35:47 GMT

Sure. Here are the most relevant part of my file-servers.xml.

  <config evaluator="string-compare" condition="CIFS Server">
          <serverEnable enabled="true"/>
      <host name="${cifs.localname}" domain="${cifs.domain}"/>
      <comment>Alfresco CIFS Server</comment>

      <!– Set to the broadcast mask for the subnet –>
      <broadcast>${cifs.broadcast}</broadcast>

      <!– Use Java socket based NetBIOS over TCP/IP and native SMB on linux –>
      <tcpipSMB platforms="linux,solaris,macosx"/>
      <netBIOSSMB platforms="linux,solaris,macosx"/>

           <!– Can be mapped to non-privileged ports, then use firewall rules to forward
                    requests from the standard ports –>
          <!–     
      <tcpipSMB port="1445" platforms="linux,solaris,macosx"/>
      <netBIOSSMB sessionPort="1139" namePort="1137" datagramPort="1138" platforms="linux,solaris,macosx"/>
          –>

      <hostAnnounce interval="5"/>

      <!– Use Win32 NetBIOS interface on Windows –>
      <Win32NetBIOS/>
      <Win32Announce interval="5"/>

      <!– CIFS authentication –>
      <authenticator type="enterprise">
        <KDC>dcbi.mydomain.com</KDC>
        <Realm>MYDOMAIN</Realm>
        <Password>alfresco</Password>
        <Principal>cifs/gandalf-white.mydomain.com</Principal>
      </authenticator>

<!–
      <WINS>
         <primary>1.2.3.4</primary>
         <secondary>5.6.7.8</secondary>
      </WINS>
–>
      <sessionDebug flags="Negotiate,Socket"/>
   </config>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

 <config evaluator="string-compare" condition="Filesystem Security">

      <authenticator type="enterprise">
      <KDC>dcbi.mydomain.com</KDC>
      <Realm>MYDOMAIN</Realm>
      <Password>alfresco</Password>
      <Principal>cifs/gandalf-white.mydomain.com</Principal>
      </authenticator>

   </config>
‍‍‍‍‍‍‍‍‍‍‍

At start-up:

18:22:14,540 User:System DEBUG [smb.protocol.auth] Logged on using principal cifs/gandalf-white.mydomain.com@MYDOMAIN
18:22:14,540 User:System DEBUG [smb.protocol.auth] Enabling mechTypes :-
18:22:14,540 User:System DEBUG [smb.protocol.auth]   Kerberos5
18:22:14,540 User:System DEBUG [smb.protocol.auth]   MS-Kerberos5
18:22:14,541 User:System DEBUG [smb.protocol.auth]   NTLMSSP
18:22:14,547 User:System INFO  [alfresco.smb.protocol] CIFS server started
18:22:14,547 User:System INFO  [alfresco.smb.protocol] FTP server NOT started
18:22:14,547 User:System INFO  [alfresco.smb.protocol] NFS server NOT started
‍‍‍‍‍‍‍‍‍

Here is the log output:

18:22:29,634  DEBUG [smb.protocol.auth] NT Session setup SPNEGO, MID=8, UID=0, PID=65279
18:22:29,639  DEBUG [smb.protocol.auth] Kerberos AP-REQ - [AP-REQ:APOptions=MutualAuth ,Ticket=Len=
912,Authenticator=EncType=3,Kvno=-1,Len=168]
18:22:29,640  DEBUG [smb.protocol.auth] Kerberos mutual auth required, parsing AP-REQ
18:22:29,666  DEBUG [smb.protocol.auth] Using OID MS Kerberos5 for NegTokenTarg
18:22:29,670  DEBUG [smb.protocol.auth] Created NegTokenTarg using updated AP-REP, added subkey
18:22:29,670  DEBUG [smb.protocol.auth] Machine account logon, MPWKS150$, as null logon
18:22:29,670  DEBUG [smb.protocol.auth] Logged on using Kerberos, user MPWKS150$
18:22:29,671  DEBUG [smb.protocol.auth] User  logged on  (type Null)
18:22:29,672  DEBUG [smb.protocol.auth] Allocated UID=0 for VC=[0:0,[:null,Windows 2002 Service Pac
k 3 2600,Windows 2002 5.1,10.250.15.39],Tree=0,Searches=0]
18:22:29,695  DEBUG [smb.protocol.auth] NT Session setup SPNEGO, MID=24, UID=0, PID=65279
18:22:29,701  DEBUG [smb.protocol.auth] Kerberos AP-REQ - [AP-REQ:APOptions=MutualAuth ,Ticket=Len=
1184,Authenticator=EncType=3,Kvno=-1,Len=168]
18:22:29,701  DEBUG [smb.protocol.auth] Kerberos mutual auth required, parsing AP-REQ
18:22:29,717  DEBUG [smb.protocol.auth] Using OID MS Kerberos5 for NegTokenTarg
18:22:29,719  DEBUG [smb.protocol.auth] Created NegTokenTarg using updated AP-REP, added subkey
18:22:29,841 User:fredb ERROR [smb.protocol.auth] Kerberos logon error
18:22:29,841 User:fredb ERROR [smb.protocol.auth] org.alfresco.repo.security.authentication.Authent
icationException: Could not find user by userName: fredb
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

So, if log in with a user and try to access a CIFS share, and the user didn't previously existed in Alfresco, it does get in somehow. I can see the user when going to the alfresco admin console that got created. So it authenticates, but then, fails to find the user?

I wish this was a trivial config issue

Thanks for any tips..
fred

Re: Kerberos auth on HEAD

rogier_oudshoor — Tue, 17 Feb 2009 12:48:30 GMT

I've seen such an issue before, but not in the context of CIFS. Alfresco used to require a valid local authentication in order to validate a ticket. However, I don't think CIFS uses tickets.

topic Re: Kerberos auth on HEAD in Alfresco Archive

Kerberos auth on HEAD

Re: Kerberos auth on HEAD

Re: Kerberos auth on HEAD

Re: Kerberos auth on HEAD

Re: Kerberos auth on HEAD