topic Re: LDAP/Active Directory authentication AGAIN-why is so hard? in Alfresco Archive

LDAP/Active Directory authentication AGAIN-why is so hard?

bxiang — Mon, 09 Mar 2009 16:42:30 GMT

Hi,We are currently evaluating Alfresco/Nuxeo. I got Nuxeo authenticated against Active Directory using LDAP pretty quickly. But I can not get Alfresco authentication working using LDAP(Active Diretory) even after few days struggling. Here is what I did:1) Download Lab 3stable (tomcat bundle).2) Sta

Re: LDAP/Active Directory authentication AGAIN-why is so hard?

loftux — Mon, 09 Mar 2009 17:53:25 GMT

Try to specify your login as
ldap.authentication.java.naming.security.principal=CN=tlr\admin,OU=Dev,DC=tlr,DC=com

Re: LDAP/Active Directory authentication AGAIN-why is so hard?

bxiang — Mon, 09 Mar 2009 21:39:03 GMT

Thanks Loftux! I got it working by using

ldap.authentication.userNameFormat=%s@tlr.com‍

Camparing it to Nuxeo's ldap, I think Alfreso LDAP is missing following:

- 1 ability to specify the LDAP context root, such as OU=blah,DC=company,DC=com.

ldap.authentication.userNameFormat=CN=%s,OU=Dev,DC=tlr,DC=com‍

does not work in my case because the Distinguish Name for certain user might be something like:

CN=someuserid,OU=dep,OU=PEOPLE,OU=Dev,DC=tlr,DC=com‍

- 2 ability to specify the SearchScope be one of options:

javax.naming.directory.SearchControl.SUBTREE_SCOPE
javax.naming.directory.SearchControl.ONELEVEL_SCOPE‍‍

- 3 ability to specify the default admin userid and default group for LDAP authentication(Nuxeo can!). This is a major pain right now! Once configured using LDAP. I login using LDAP userid, I can only be a regular user. I lost the Admin account. So I have to Chain LDAP and Alfreso internal authentication in order to get the Admin account back ( Anybody know any other way?) But Chaining is NOT working at all. I searched the forum. It seems few people have already complained this issue. I got this exception chaining LDAP + Alfreso internal authentication:
17:22:09,283 ERROR [org.springframework.web.context.ContextLoader] Context initialization failed

java.lang.NullPointerException
   at org.alfresco.repo.security.authentication.AbstractAuthenticationComponent.isSystemUserName(AbstractAuthenticationComponent.java:299)
   at org.alfresco.repo.security.authentication.AbstractAuthenticationComponent.setCurrentUser(AbstractAuthenticationComponent.java:161)
   at org.alfresco.repo.security.authentication.ChainingAuthenticationComponentImpl.setCurrentUser(ChainingAuthenticationComponentImpl.java:373)
   at org.alfresco.repo.security.authentication.ChainingAuthenticationComponentImpl.setSystemUserAsCurrentUser(ChainingAuthenticationComponentImpl.java:407)
   at org.alfresco.repo.importer.system.SystemInfoBootstrap.bootstrap(SystemInfoBootstrap.java:124)
   at org.alfresco.repo.importer.system.SystemInfoBootstrap.onBootstrap(SystemInfoBootstrap.java:190)
   at org.alfresco.util.AbstractLifecycleBean.onApplicationEvent(AbstractLifecycleBean.java:62)
   at org.springframework.context.event.SimpleApplicationEventMulticaster$1.run(SimpleApplicationEventMulticaster.java:77)
   at org.springframework.core.task.SyncTaskExecutor.execute(SyncTaskExecutor.java:49)
   at org.springframework.context.event.SimpleApplicationEventMulticaster.multicastEvent(SimpleApplicationEventMulticaster.java:75)
   at org.springframework.context.support.AbstractApplicationContext.publishEvent(AbstractApplicationContext.java:246)
   at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:355)
   at org.springframework.web.context.ContextLoader.createWebApplicationContext(ContextLoader.java:244)
   at org.springframework.web.context.ContextLoader.initWebApplicationContext(ContextLoader.java:187)
   at org.springframework.web.context.ContextLoaderListener.contextInitialized(ContextLoaderListener.java:49)
   at org.apache.catalina.core.StandardContext.listenerStart(StandardContext.java:3843)
   at org.apache.catalina.core.StandardContext.start(StandardContext.java:4342)
   at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:791)
   at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:771)
   at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:525)
   at org.apache.catalina.startup.HostConfig.deployWAR(HostConfig.java:830)
   at org.apache.catalina.startup.HostConfig.deployWARs(HostConfig.java:719)
   at org.apache.catalina.startup.HostConfig.deployApps(HostConfig.java:490)
   at org.apache.catalina.startup.HostConfig.start(HostConfig.java:1149)
   at org.apache.catalina.startup.HostConfig.lifecycleEvent(HostConfig.java:311)
   at org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(LifecycleSupport.java:117)
   at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1053)
   at org.apache.catalina.core.StandardHost.start(StandardHost.java:719)
   at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1045)
   at org.apache.catalina.core.StandardEngine.start(StandardEngine.java:443)
   at org.apache.catalina.core.StandardService.start(StandardService.java:516)
   at org.apache.catalina.core.StandardServer.start(StandardServer.java:710)
   at org.apache.catalina.startup.Catalina.start(Catalina.java:578)
   at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
   at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
   at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
   at java.lang.reflect.Method.invoke(Method.java:597)
   at org.apache.catalina.startup.Bootstrap.start(Bootstrap.java:288)
   at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:413)‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Can someone give me some hint where do I go from here?
Thanks,
Brian

Re: LDAP/Active Directory authentication AGAIN-why is so hard?

troga — Tue, 10 Mar 2009 07:41:35 GMT

Hi Brian

I am also in Trouble now, with Alfresco and Active Directory, it is really a pain…..
http://forums.alfresco.com/en/viewtopic.php?f=9&t=17435

How was your solution with CIFS? Did you changed something?

Best Regards
Troga

Re: LDAP/Active Directory authentication AGAIN-why is so hard?

jtp — Tue, 10 Mar 2009 12:06:14 GMT

- 3 ability to specify the default admin userid and default group for LDAP authentication(Nuxeo can!). This is a major pain right now! Once configured using LDAP. I login using LDAP userid, I can only be a regular user. I lost the Admin account. So I have to Chain LDAP and Alfreso internal authentication in order to get the Admin account back ( Anybody know any other way?) But Chaining is NOT working at all. I searched the forum. It seems few people have already complained this issue. I got this exception chaining LDAP + Alfreso internal authentication:

You don't need chaining, just enable an LDAP account as an admin. Works for my NTLM setup, should work for you.
(From the Wiki)
File custom-authority-services-context.xml in tomcat\shared\classes\alfresco\extension (or equivalent) allows such a configurations. (in 2.1(linux) it can be found in tomcat/webapps/alfresco/WEB-INF/classes/alfresco/authority-services-context.xml

For example…

<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE beans PUBLIC '-//SPRING//DTD BEAN//EN' 'http://www.springframework.org/dtd/spring-beans.dtd'>
<beans>
    <bean id="authorityService" class="org.alfresco.repo.security.authority.AuthorityServiceImpl">
        <property name="authenticationComponent">
            <ref bean="authenticationComponent" />
        </property>
        <property name="personService">
            <ref bean="personService" />
        </property>
        <property name="nodeService">
            <ref bean="nodeService" />
        </property>
        <property name="authorityDAO">
            <ref bean="authorityDAO" />
        </property>
        <property name="permissionServiceSPI">
            <ref bean="permissionServiceImpl" />
        </property>
        <property name="adminUsers">
            <set>
                <value>smithj</value> <!– add an NTLM user as an Administrator –>
                <value>admin</value>
                <value>administrator</value>
            </set>
        </property>
    </bean>
</beans>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Re: LDAP/Active Directory authentication AGAIN-why is so hard?

bxiang — Tue, 10 Mar 2009 13:47:51 GMT

Thanks JTP!
That is what I ended up with changing authority-services-context.xml. They should allow configuring this from ldap-cuahtentication.properties because LDAP is such a common requirement and you need admin account as well when working with LDAP.

Troja,
I did not try to configure CIFS with LDAP. We just need basic LDAP authentication for evaluation purpose. While I was searching the forum, I saw a few threads related to CIFS/LDAP. If it has to use Chaining, good luck with that! I do not think chaining is working without doing something like diving into authority-services-context.xml to make some change.

-Brian