topic Re: Alfresco/Ldap connect, but not authenticate - V3.0 in Alfresco Archive

Alfresco/Ldap connect, but not authenticate - V3.0

nowhere — Tue, 17 Feb 2009 13:02:31 GMT

Hi all,i'm encountering problems with alfresco - apacheDS integration.Now i'll try to explain my troubles…Following wiki instuction and several posts in this forum I've configured and renamed (cut off ".sample") those files:- ldap-authentication-context.xml- ldap-authentication.properties- ldap-sync

Re: Alfresco/Ldap connect, but not authenticate - V3.0

cheffilet — Tue, 17 Feb 2009 14:38:51 GMT

What is your login name?

Re: Alfresco/Ldap connect, but not authenticate - V3.0

nowhere — Tue, 17 Feb 2009 14:44:19 GMT

Do you mean the user name i try to log in alfresco? I use "paolo" as defined in my ldap server with dn: cn=paolo,ou=users,ou=system and I use password as defined in attribute userPassword.
I hope this was your question…excuse me for my bad english.
Greetings

Re: Alfresco/Ldap connect, but not authenticate - V3.0

nowhere — Tue, 17 Feb 2009 15:46:42 GMT

I tried to configure chaining, my chaining-authentication-context.xml appears as follow:

<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE beans PUBLIC '-//SPRING//DTD BEAN//EN' 'http://www.springframework.org/dtd/spring-beans.dtd'>

<beans>
    
   
    
    <!– Chaining of both the services and components –>
    
    <bean id="authenticationService" class="org.alfresco.repo.security.authentication.ChainingAuthenticationServiceImpl">
        <property name="authenticationServices">
            <list>
                <ref bean="authenticationServiceImplJAAS"/>
            </list>
        </property>
        <property name="mutableAuthenticationService">
            <ref bean="authenticationServiceImplAlfresco"/>
        </property>
        <property name="sysAdminCache">
            <ref bean="sysAdminCache"/>
        </property>
    </bean>
    
    <bean id="authenticationComponent" class="org.alfresco.repo.security.authentication.ChainingAuthenticationComponentImpl">
      <property name="authenticationComponents">
            <list>
                <ref bean="authenticationComponentImplJAAS"/>
            </list>
        </property>
        <property name="mutableAuthenticationComponent">
            <ref bean="authenticationComponentImplAlfresco"/>
        </property>
   </bean>
    
    <!– Alfresco Auth –>
    
    <bean id="authenticationServiceImplAlfresco" class="org.alfresco.repo.security.authentication.AuthenticationServiceImpl">
        <property name="authenticationDao">
            <ref bean="authenticationDaoAlfresco"/>
        </property>
        <property name="ticketComponent">
            <ref bean="ticketComponent"/>
        </property>
        <property name="authenticationComponent">
            <ref bean="authenticationComponentImplAlfresco"/>
        </property>
        <property name="sysAdminCache">
            <ref bean="sysAdminCache"/>
        </property>
    </bean>
    
    <bean id="authenticationDaoAlfresco" class="org.alfresco.repo.security.authentication.RepositoryAuthenticationDao">
        <property name="nodeService">
            <ref bean="nodeService"/>
        </property>
        <property name="tenantService">
            <ref bean="tenantService"/>
        </property>
        <property name="dictionaryService">
            <ref bean="dictionaryService"/>
        </property>
        <property name="namespaceService">
            <ref bean="namespaceService"/>
        </property>
        <property name="searchService">
            <ref bean="admSearchService"/>
        </property>
        <property name="retryingTransactionHelper">
          <ref bean="retryingTransactionHelper"/>
        </property>
        <property name="userNamesAreCaseSensitive">
            <value>${user.name.caseSensitive}</value>
        </property>
        <property name="passwordEncoder">
            <ref bean="passwordEncoder"/>
        </property>
    </bean>
    
    <bean id="authenticationComponentImplAlfresco" class="org.alfresco.repo.security.authentication.AuthenticationComponentImpl" parent="authenticationComponentBase">
        <property name="authenticationDao">
            <ref bean="authenticationDaoAlfresco"/>
        </property>
        <property name="authenticationManager">
            <ref bean="authenticationManager"/>
        </property>
        <property name="allowGuestLogin">
            <value>true</value>
        </property>
        <property name="nodeService">
            <ref bean="nodeService" />
        </property>
        <property name="personService">
            <ref bean="personService" />
        </property>
        <property name="transactionService">
            <ref bean="transactionService" />
        </property>
    </bean>

   <!– ldap –> 
<bean id="authenticationServiceImplLDAP" class="org.alfresco.repo.security.authentication.AuthenticationServiceImpl" lazy-init="default" autowire="default" dependency-check="default">
 <property name="authenticationDao">
  <ref bean="authenticationDaoLDAP" /> 
  </property>
 <property name="ticketComponent">
  <ref bean="ticketComponent" /> 
  </property>
 <property name="authenticationComponent">
  <ref bean="authenticationComponentImplLDAP" /> 
  </property>
</bean>
<bean id="authenticationComponentImplLDAP" class="org.alfresco.repo.security.authentication.ldap.LDAPAuthenticationComponentImpl" lazy-init="default" autowire="default" dependency-check="default">
 <property name="LDAPInitialDirContextFactory">
  <ref bean="ldapInitialDirContextFactory" /> 
  </property>
 <property name="userNameFormat">
 <!–  cn=Manager,dc=khaz-domain,dc=com 
  –> 
  <value>cn=%s,ou=users,ou=system</value> 
  </property>
  </bean>
  <bean id="authenticationDaoLDAP" class="org.alfresco.repo.security.authentication.ntlm.NullMutableAuthenticationDao" lazy-init="default" autowire="default" dependency-check="default" />
<!– fine –>
    
    <!– JAAS –>
    
    <bean id="authenticationServiceImplJAAS" class="org.alfresco.repo.security.authentication.AuthenticationServiceImpl">
        <property name="authenticationDao">
            <ref bean="authenticationDaoJAAS"/>
        </property>
        <property name="ticketComponent">
            <ref bean="ticketComponent"/>
        </property>
        <property name="authenticationComponent">
            <ref bean="authenticationComponentImplJAAS"/>
        </property>
        <property name="sysAdminCache">
            <ref bean="sysAdminCache"/>
        </property>
    </bean>
    
    <bean id="authenticationComponentImplJAAS" class="org.alfresco.repo.security.authentication.jaas.JAASAuthenticationComponent">
        <property name="realm">
            <value>COMPANY.COM</value>
        </property>
        <property name="jaasConfigEntryName">
            <value>Alfresco</value>
        </property>
        <property name="nodeService">
            <ref bean="nodeService" />
        </property>
        <property name="personService">
            <ref bean="personService" />
        </property>
        <property name="transactionService">
            <ref bean="transactionService" />
        </property>
    </bean>
    
    <bean id="authenticationDaoJAAS" class="org.alfresco.repo.security.authentication.ntlm.NullMutableAuthenticationDao"/>
    
</beans>‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

In this case, logging as admin/admin or as paolo/pwd I get the following exception:

javax.faces.FacesException: Error calling action method of component with id loginForm:submit
caused by:
javax.faces.el.EvaluationException: Exception while invoking expression #{LoginBean.login}
caused by:
org.alfresco.error.AlfrescoRuntimeException: Not implemented

Any ideas? I'd like to consigure authentication with ldap server, also without chaining…
Thanks for any suggestions

Re: Alfresco/Ldap connect, but not authenticate - V3.0

nowhere — Tue, 17 Feb 2009 18:16:16 GMT

Hi again…
I also tried configuration with DIGEST:

#
# This properties file brings together the common options for LDAP authentication rather than editing the bean definitions
#

# How to map the user id entered by the user to taht passed through to LDAP
# - simple 
#    - this must be a DN and would be something like
#      CN=%s,DC=company,DC=com
# - digest
#    - usually pass through what is entered
#      %s     
ldap.authentication.userNameFormat=%s
# The LDAP context factory to use
ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory

# The URL to connect to the LDAP server 
ldap.authentication.java.naming.provider.url=ldap://ldap.example.com:10389

# The authentication mechanism to use
ldap.authentication.java.naming.security.authentication=DIGEST-MD5

# The default principal to use (only used for LDAP sync)
ldap.authentication.java.naming.security.principal=reader

# The password for the default principal (only used for LDAP sync)
ldap.authentication.java.naming.security.credentials=secret

# Escape commas entered by the user at bind time
# Useful when using simple authentication and the CN is part of the DN and contains commas
ldap.authentication.escapeCommasInBind=false

# Escape commas entered by the user when setting the authenticated user
# Useful when using simple authentication and the CN is part of the DN and contains commas, and the escaped \, is 
# pulled in as part of an LDAP sync
# If this option is set to true it will break the default home folder provider as space names can not contain \
ldap.authentication.escapeCommasInUid=false‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Don't care of "ldap.authentication.java.naming.security.principal" and credentials, i set them in ldap-authentication-context.xml as follow:

<entry key="java.naming.security.principal">
                    <value>uid=admin,ou=system</value>
                </entry>
                
                <!– The password for the user defined above –>
                <entry key="java.naming.security.credentials">
                    <value>secret</value>
                </entry>
‍‍‍‍‍‍‍‍‍

and I get the following error (from ApancheDs log):

ERROR [org.apache.directory.server.ldap.handlers.BindHandler] - INVALID_CREDENTIALS: DIGEST-MD5: cannot acquire password for uid=admin,ou=system in realm : example.com‍

Hoping in some suggestions…i can't get out of this…

Re: Alfresco/Ldap connect, but not authenticate - V3.0

nowhere — Wed, 18 Feb 2009 16:32:57 GMT

Some else information…if someone can help me:
when I start Catalina, I get the following log:

17:23:50,390  INFO  [authentication.ldap.LDAPInitialDirContextFactoryImpl] LDAP
server does not fall back to anonymous bind for a string uid and password at lda
p://ldap.example.com:10389/
17:23:50,515  INFO  [authentication.ldap.LDAPInitialDirContextFactoryImpl] LDAP
server does not fall back to anonymous bind for a simple dn and password at ldap
://ldap.example.com:10389/
17:23:50,640  INFO  [authentication.ldap.LDAPInitialDirContextFactoryImpl] LDAP
server does not fall back to anonymous bind for known principal and invalid cred
entials at ldap://ldap.example.com:10389/‍‍‍‍‍‍‍‍‍

and, always the log shows after a few minutes:

17:30:01,187  DEBUG [authentication.ldap.LDAPPersonExportSource] Adding user for
 admin
17:30:01,187  DEBUG [authentication.ldap.LDAPPersonExportSource] Adding user for
 fullname
17:30:01,203  DEBUG [authentication.ldap.LDAPPersonExportSource] Adding user for
 adminrosa
17:30:01,218  DEBUG [authentication.ldap.LDAPPersonExportSource] Adding user for
 valerio
17:30:01,484  DEBUG [authentication.ldap.LDAPGroupExportSource] Found 1
17:30:01,484  DEBUG [authentication.ldap.LDAPGroupExportSource] Linking GROUP_Gr
oup One
17:30:01,484  DEBUG [authentication.ldap.LDAPGroupExportSource] … cn=Full Name
,dc=example,dc=com
17:30:01,593  DEBUG [authentication.ldap.LDAPGroupExportSource] … is member
17:30:01,593  DEBUG [authentication.ldap.LDAPGroupExportSource] Top 1
17:30:01,593  DEBUG [authentication.ldap.LDAPGroupExportSource] Secondary 0‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

but authentication fails…despite the ldap comunication seems to be working.
Why?

Re: Alfresco/Ldap connect, but not authenticate - V3.0

jcuzcano — Wed, 18 Feb 2009 17:08:52 GMT

hi

in my case, alfresco.log is show this

11:59:04,638 WARN [org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl] LDAP server supports anonymous bind ldap://ldap.com:389
11:59:04,653 INFO [org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl] LDAP server does not support simple string user ids and invalid credentials at ldap://ldap.com:389
11:59:04,700 INFO [org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl] LDAP server does not fall back to anonymous bind for a simple dn and password at ldap://ldap.com:389
11:59:04,716 INFO [org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl] LDAP server does not fall back to anonymous bind for known principal and invalid credentials at ldap://ldap.com:389

but the process import users not was started!!!

Re: Alfresco/Ldap connect, but not authenticate - V3.0

jcuzcano — Wed, 18 Feb 2009 17:11:25 GMT

I'm working with Alfresco 2.1 with OpenLdap

Re: Alfresco/Ldap connect, but not authenticate - V3.0

nowhere — Wed, 18 Feb 2009 17:18:15 GMT

What's your "ldap.synchronisation.import.person.cron" setting?
If it can help you, read this: https://issues.alfresco.com/jira/browse/ALFCOM-1211, it seems that if your ldap server accepts anonymous bind alfresco will not work with it…

Re: Alfresco/Ldap connect, but not authenticate - V3.0

jcuzcano — Wed, 18 Feb 2009 18:01:40 GMT

in my ldap.synchronisation.properties file modify this parameter
ldap.synchronisation.import.person.cron=0 0/1 * * * ? then this job execute each minute

but alfresco log get this information

12:57:00,021 ERROR [org.quartz.core.JobRunShell] Job DEFAULT.ldapPeopleJobDetail threw an unhandled Exception:
java.lang.NullPointerException
   at org.alfresco.repo.importer.ExportSourceImporter.doImport(ExportSourceImporter.java:218)
   at org.alfresco.repo.importer.ImporterJob.execute(ImporterJob.java:44)
   at org.quartz.core.JobRunShell.run(JobRunShell.java:202)
   at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:529)
12:57:00,021 ERROR [org.quartz.core.ErrorLogger] Job (DEFAULT.ldapPeopleJobDetail threw an exception.
org.quartz.SchedulerException: Job threw an unhandled exception. [See nested exception: java.lang.NullPointerException]
   at org.quartz.core.JobRunShell.run(JobRunShell.java:213)
   at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:529)
Caused by: java.lang.NullPointerException
   at org.alfresco.repo.importer.ExportSourceImporter.doImport(ExportSourceImporter.java:218)
   at org.alfresco.repo.importer.ImporterJob.execute(ImporterJob.java:44)
   at org.quartz.core.JobRunShell.run(JobRunShell.java:202)
   … 1 more

Re: Alfresco/Ldap connect, but not authenticate - V3.0

nowhere — Wed, 18 Feb 2009 19:00:24 GMT

Sorry, i'm completely new to both Alfresco and ldap…
I can't get sinchron if I allows anonymous bind on my ldap server and use ldap.authentication.java.naming.security.authentication=simple, but with a different exception from you.
If I were you, as thumb's rule, I'd deny anonymous bind on openldap because it's known to cause problem with alfresco. Otherwise use authentication=DIGEST-MD5… it works also with anonymous bind allowed for me.
Let me know 🙂

Re: Alfresco/Ldap connect, but not authenticate - V3.0

nowhere — Thu, 19 Feb 2009 10:25:32 GMT

Can someone make a list of files to modify in order to get ldap working? So I could review my configuration…
Thanks in advance,
Nowhere

Re: Alfresco/Ldap connect, but not authenticate - V3.0

eduardoc — Mon, 06 Jul 2009 19:11:25 GMT

Hi Nowhere,

Did you get some response?
Can you share with us?

Thanks.

Re: Alfresco/Ldap connect, but not authenticate - V3.0

mautidavis — Mon, 10 Aug 2009 13:25:32 GMT

Dear all,

I am almost getting the same problem with LDAP. Please find attached a portion of my catalina.out log file:

catalina.out


16:00:00,019  ERROR [quartz.core.JobRunShell] Job DEFAULT.ldapPeopleJobDetail threw an unhandled Exception:
org.alfresco.repo.importer.ExportSourceImporterException: Failed to import
        at org.alfresco.repo.importer.ExportSourceImporter.doImport(ExportSourceImporter.java:211)
        at org.alfresco.repo.importer.ImporterJob.execute(ImporterJob.java:44)
        at org.quartz.core.JobRunShell.run(JobRunShell.java:202)
        at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:529)
Caused by: org.alfresco.repo.security.authentication.AuthenticationException: LDAP authentication failed.
        at org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl.buildInitialDirContext(LDAPInitialDirContextFactoryImpl.java:90)
        at org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl.getDefaultIntialDirContext(LDAPInitialDirContextFactoryImpl.java:79)
        at org.alfresco.repo.security.authentication.ldap.LDAPPersonExportSource.generateExport(LDAPPersonExportSource.java:160)
        at org.alfresco.repo.importer.ExportSourceImporter.doImport(ExportSourceImporter.java:178)
        … 3 more
Caused by: javax.naming.AuthenticationException: [LDAP: error code 49 - 8009030C: LdapErr: DSID-0C09043E, comment: AcceptSecurityContext error, data 0, vece]
        at com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:3005)
        at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2951)
        at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2753)
        at com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2667)
        at com.sun.jndi.ldap.LdapCtx.<init>(LdapCtx.java:287)
        at com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(LdapCtxFactory.java:175)
        at com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(LdapCtxFactory.java:193)
        at com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxInstance(LdapCtxFactory.java:136)
        at com.sun.jndi.ldap.LdapCtxFactory.getInitialContext(LdapCtxFactory.java:66)
        at javax.naming.spi.NamingManager.getInitialContext(NamingManager.java:667)
        at javax.naming.InitialContext.getDefaultInitCtx(InitialContext.java:288)
        at javax.naming.InitialContext.init(InitialContext.java:223)
        at javax.naming.InitialContext.<init>(InitialContext.java:197)
        at javax.naming.directory.InitialDirContext.<init>(InitialDirContext.java:82)
        at org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl.buildInitialDirContext(LDAPInitialDirContextFactoryImpl.java:86)

‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

it seems that the authenitication works but importation of users is not possible ( i hope that this is correct interpretation of this log file). What might be preventing the importation? Please help.

Regards,
Davis M Onsakia

Re: Alfresco/Ldap connect, but not authenticate - V3.0

dward — Mon, 10 Aug 2009 13:33:47 GMT

For any other confused readers, we're talking about v3.0 here. Please ignore this thread if you are configuring v3.2 because all you need to worry about is alfresco-global.properties.

Please double-check the following parameter values in $TOMCAT_HOME/alfresco/extension/ldap-authentication.properties

ldap.authentication.java.naming.security.authentication
ldap.authentication.java.naming.security.principal
ldap.authentication.java.naming.security.credentials

You have to be able to connect to the LDAP directory using that type of bind and that username and password. Here's typical values for OpenLDAP:

ldap.authentication.java.naming.security.authentication=simple
ldap.authentication.java.naming.security.principal=cn=Manager,dc=company,dc=com
ldap.authentication.java.naming.security.credentials=secret

Here's typical values for Active Directory:

ldap.authentication.java.naming.security.authentication=simple
ldap.authentication.java.naming.security.principal=alfresco@domain
ldap.authentication.java.naming.security.credentials=password

Please do not try to use this advice on v3.2 - the parameter names have changed!

Re: Alfresco/Ldap connect, but not authenticate - V3.0

brice — Fri, 04 Dec 2009 16:22:34 GMT

dward, please, would you be so kind giving us corresponding 3.2 parameters' names ?!

I tried many configuration and still cannot authenticate whereas these properties work with apache :
AuthType Basic
AuthBasicProvider ldap
AuthLDAPBindDN "cn=admin,dc=myCompany,dc=com"
AuthLDAPBindPassword "secret"
AuthLDAPURL "ldap://127.0.0.1:389/ou=people,dc=myCompany,dc=com?uid"
AuthLDAPGroupAttributeIsDN on
Require ldap-group cn=myprivategroup,ou=groups ,dc=myCompany,dc=com

my best guess would be something as :
ldap.authentication.userNameFormat=%s
ldap.authentication.java.naming.provider.url=ldap://127.0.0.1:389/cn=admin,ou=people,dc=myCompany,dc=com?uid
ldap.authentication.java.naming.security.authentication=simple
ldap.authentication.escapeCommasInBind=true
ldap.authentication.escapeCommasInUid=true

but I don't see where to put admin credentials but to the synchronisation part, which is not mandatory !

Re: Alfresco/Ldap connect, but not authenticate - V3.0

dward — Mon, 07 Dec 2009 09:29:44 GMT

ldap.authentication.java.naming.provider.url=ldap://127.0.0.1:389
ldap.synchronization.java.naming.security.principal=cn\=admin,ou\=people,dc\=myCompany,dc\=com
ldap.synchronization.java.naming.security.credentials=secret
ldap.synchronization.groupSearchBase=ou\=groups,dc\=myCompany,dc\=com
ldap.synchronization.userSearchBase=ou\=people,dc\=myCompany,dc\=com