topic CIFS Issues in Alfresco Archive

CIFS Issues

durrell — Thu, 30 Jul 2009 15:37:25 GMT

This is my last remaining issue with my Alfresco implementation.I can't map drives to Alfresco, nor can I authenticate by just trying to connect to \\alfresco.Error log is telling me this:11:32:23,721 DEBUG [org.alfresco.smb.protocol.auth] Passthru sessId=7, auth ctx=[NTLM,Challenge=299c1e9102a9485e

Re: CIFS Issues

jarrett — Thu, 30 Jul 2009 16:30:49 GMT

can you post your file-servers-custom.xml ?

Re: CIFS Issues

durrell — Thu, 30 Jul 2009 18:11:37 GMT

<alfresco-config area="file-servers">
<config evaluator="string-compare" condition="CIFS Server"
 replace="true">
          <serverEnable enabled="true"/>
          <host name="${localname}A" domain="MYDOMAIN"/>
          <!– The name attribute can use the special token of
 {localname} to use the local servers host name and generate a unique name by prepending/appending to it. –>
          <comment>Alfresco CIFS Server</comment>

          <!– Set to the broadcast mask for the subnet –>
          <broadcast>255.255.0.0</broadcast>

          <!– Use Java socket based NetBIOS over TCP/IP and native SMB on linux –>
          <tcpipSMB platforms="linux,solaris,macosx"/>
          <netBIOSSMB platforms="linux,solaris,macosx"/>

          <!– Use Win32 NetBIOS interface on Windows –>
          <Win32NetBIOS/>
          <Win32Announce interval="5"/>
          <hostAnnounce interval="5"/>

          <!–The following defines the authentication connector to an AD server –>
          <authenticator type="passthru">
               <!– within the following tag place a comma delimited list of your AD servers that Alfresco should talk to–>
               <Server>10.0.1.1</Server>
          </authenticator>

          <sessionDebug flags="Negotiate,Socket"/>
</config>
</alfresco-config>‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Re: CIFS Issues

ofrxnz — Fri, 31 Jul 2009 14:27:43 GMT

This is one of the places where the "A" comes in…..I think there may be one in web-client.config as well. I know the web-client.config files hold things like the cifs domain suffix

this is line 5 of the config you posted

<host name="${localname}A" domain="MYDOMAIN"/>

you will want

<host name="${localname}" domain="MYDOMAIN"/>

The A is added because when alfresco runs on windows, windows fights alfresco for controll of the cifs like no one's business

Re: CIFS Issues

durrell — Fri, 31 Jul 2009 17:20:45 GMT

Yeah, I noticed that. I went ahead and edited it.

The interesting thing is that it sees the Alfresco server fine when I used \\alfresco, and according to the logs we are authenticating properly and a session is opening up, but it declines my credentials and acts like they aren't correct.

I'm assuming I just have something misconfigured, I just can't figure out what it is.

Re: CIFS Issues

ofrxnz — Fri, 31 Jul 2009 17:27:39 GMT

could you post your file-servers-config-custom.xml file as well as any custom authentication files you are using…

it should be in the "tomcat->shared" directory…..also, if your not using that could you post the "file-servers.properties" file

there are some restrictions on authentication mechanisms for cifs

Re: CIFS Issues

durrell — Fri, 31 Jul 2009 18:59:21 GMT

I posted the file-servers-config earliier.

I am using strictly LDAP authentication with the "simple" auth method, no Kerberos or anything. What would you need to see?

Re: CIFS Issues

ofrxnz — Fri, 31 Jul 2009 19:05:26 GMT

Thats it…

LDAP does not support CIFS.

you will have to use NTLM(alfresco or passthru) or Kerberos.

here is a link to the 3.2 information…I remember the same was true for every previous version i looked at too.

http://wiki.alfresco.com/wiki/Alfresco_Authentication_Subsystems#What_are_the_Authentication_Subsystems.3F

Passthru is not hard to setup if you are using Active directory 2k3 and if you are using 2k7(8?) you probably want to use kerberos

Re: CIFS Issues

durrell — Fri, 31 Jul 2009 19:45:28 GMT

Well I have CIFS configured to use Passthru and it appears to authenticate somewhat. It's just failing right after that.

Maybe I'm missing some sort of configuration somewhere?

Re: CIFS Issues

ofrxnz — Fri, 31 Jul 2009 19:48:55 GMT

Could you post your authentication configuration.

Re: CIFS Issues

durrell — Sat, 01 Aug 2009 05:56:18 GMT

I'm assuming you mean ldap-authentication.properties.



# This properties file brings together the common options for LDAP authentication rather than editing the bean definitions
#

# How to map the user id entered by the user to taht passed through to LDAP^M
# - simple
#    - this must be a DN and would be something like
#      CN=%s,DC=company,DC=com
# - digest
#    - usually pass through what is entered
#      %s
ldap.authentication.userNameFormat=%s@domain.com

# The LDAP context factory to use
ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory

# The URL to connect to the LDAP server
ldap.authentication.java.naming.provider.url=ldap://[server name]:389

# The authentication mechanism to use
#ldap.authentication.java.naming.security.authentication=DIGEST-MD5
ldap.authentication.java.naming.security.authentication=simple

# The default principal to use (only used for LDAP sync)
ldap.authentication.java.naming.security.principal=[username]

# The password for the default principal (only used for LDAP sync)
ldap.authentication.java.naming.security.credentials=[password]

# Escape commas entered by the user at bind time
# Useful when using simple authentication and the CN is part of the DN and contains commas
ldap.authentication.escapeCommasInBind=false

# Escape commas entered by the user when setting the authenticated user
# Useful when using simple authentication and the CN is part of the DN and contains commas, and the escaped \, is
# pulled in as part of an LDAP sync
# If this option is set to true it will break the default home folder provider as space names can not contain \
ldap.authentication.escapeCommasInUid=false
~‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Re: CIFS Issues

ofrxnz — Sat, 01 Aug 2009 12:52:06 GMT

LDAP alone wont enable CIFS to work, you will need to configure NTLM using the ntlm-authentication-context.xml.samples file.

take a look at this.
http://wiki.alfresco.com/wiki/Configuring_NTLM#NTLM_Passthru_Authentication

This page should work for any alfresco version prior to 3.2

you only need to the the "NTLM passthru authentication" section and below.

Assuming you are running Active Directory 2k3 for authentication you dont need to use the "domain" configuration but just the server configuration and if you have two domain controllers 10.0.0.1 and 10.0.0.2 for the domain company.com

servers=COMPANY\10.0.0.1,COMPANY\10.0.0.2,10.0.0.1

on monday, i can get a copy of the working config i have used.

NTLM will use ports TCP:445, TCP139, UDP138, UDP137 (if i remember correctly)

Re: CIFS Issues

durrell — Sat, 01 Aug 2009 16:11:06 GMT

Man, this is great. Thanks a ton for the guidance.

I'm actually using Windows Server 2008 with Active Directory. Does that make a difference?

Re: CIFS Issues

ofrxnz — Sat, 01 Aug 2009 16:41:06 GMT

If memory serves me, NTLM is being fazed out in 2008 so it is not enabled by default. Though can be enabled.

You may want to take a look at kerberos. it seems to be replacing NTLM and uses ports tcp:88 and udp88 (i think)

I have set this up once….IT went a lot easier than it looked….The only querk was the application on AD that generates teh key literally crashed every time i ran it. But, the key was still good.

http://wiki.alfresco.com/wiki/Configuring_the_CIFS_and_web_servers_for_Kerberos/AD_integration

Re: CIFS Issues

ofrxnz — Sat, 01 Aug 2009 16:43:13 GMT

I forgot to mention you can combine NTLM+LDAP or Kerberos+LDAP.

alfresco will use NTLM or Kerberos for authentication and LDAP to synchronize user accounts

Re: CIFS Issues

durrell — Sat, 01 Aug 2009 16:51:52 GMT

LDAP sync is working perfectly, as is authentication.

As long as I have a way for users to authenticate via Active Directory, I don't care how it happens.

Using the ntlm-authentication-context.xml file, I got this in the logs:



12:54:20,235 DEBUG [org.alfresco.smb.protocol.auth] Mapped client /10.0.7.201 to domain null
12:54:20,341 DEBUG [org.alfresco.smb.protocol.auth] Passthru sessId=4, auth ctx=[NTLM,Challenge=235f636b3e9c3ea9]
12:54:20,398 DEBUG [org.alfresco.smb.protocol.auth] Using Write transaction
12:54:20,401 ERROR [org.alfresco.smb.protocol.auth] org.alfresco.jlan.smb.SMBException: Invalid parameter
12:54:20,491 DEBUG [org.alfresco.smb.protocol.auth] Using Write transaction
12:54:20,491 ERROR [org.alfresco.smb.protocol.auth] org.alfresco.jlan.smb.SMBException: Invalid parameter
12:54:20,534 DEBUG [org.alfresco.smb.protocol.auth] Using Write transaction
12:54:20,535 ERROR [org.alfresco.smb.protocol.auth] org.alfresco.jlan.smb.SMBException: Invalid parameter
12:54:20,578 DEBUG [org.alfresco.smb.protocol.auth] Using Write transaction
12:54:20,579 ERROR [org.alfresco.smb.protocol.auth] org.alfresco.jlan.smb.SMBException: Invalid parameter
12:54:29,865 DEBUG [org.alfresco.smb.protocol.auth] Mapped client /10.0.7.201 to domain null
12:54:29,869 DEBUG [org.alfresco.smb.protocol.auth] Passthru sessId=5, auth ctx=[NTLM,Challenge=474b6022dbeb0c50]
12:54:44,913 DEBUG [org.alfresco.smb.protocol.auth] Using Write transaction
12:54:44,916 ERROR [org.alfresco.smb.protocol.auth] org.alfresco.jlan.smb.SMBException: Invalid parameter
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Any ideas?

Re: CIFS Issues

ofrxnz — Sat, 01 Aug 2009 16:59:33 GMT

Mapped client /10.0.7.201 to domain null

looks like you need to manually map NTLM domains in alfresco….

basicaly they are rules that say, if the client doesn't specify their domain, assume this is their domain based on their ipaddress

you can enter multiple domain/subnets by simply repeating the Domain Name line for each one

<DomainMappings>
  <Domain name="ALFRESCO" subnet="192.168.1.0" mask="192.168.1.255"/>
</DomainMappings>
‍‍‍‍

Re: CIFS Issues

durrell — Sun, 02 Aug 2009 05:38:19 GMT

Where does that need to be mapped? The same file?

Re: CIFS Issues

ofrxnz — Sun, 02 Aug 2009 11:02:43 GMT

yeah, I think it is nested in the same parent sections as the "server" "local", etc….Ill have to wait till tomorrow til i can get a config and double check

Re: CIFS Issues

durrell — Sun, 02 Aug 2009 15:10:42 GMT

I believe that is the only section in that file that houses any config, so I'll try that and if it doesn't work then tomorrow I'll get a working config from you to base mine off of. :mrgreen: