topic Re: CIFS configuration error on ntlm / passthru / ldap-ad chain in Alfresco Archive

CIFS configuration error on ntlm / passthru / ldap-ad chain

david_labbe — Wed, 30 Jun 2010 17:31:00 GMT

Hi there,after fiddling a lot and reading a number of useful posts / books / blogs, I managed to get the basic ldap-ad synchronisation to work. I can now get the users registered in the domain controller to logon to alfresco without having to create them in Alfresco. Great.Next step is to set the pa

Re: CIFS configuration error on ntlm / passthru / ldap-ad chain

david_labbe — Thu, 01 Jul 2010 09:46:01 GMT

I also tried to invert the authentication chain as follows:

in [TOMCAT_HOME]/shared/classes/alfresco-global.properties:

authentication.chain=alfrescoNtlm1:alfrescoNtlm, ldap-ad1:ldap-ad, passthru1:passthru‍

but same results…

Re: CIFS configuration error on ntlm / passthru / ldap-ad chain

dward — Thu, 01 Jul 2010 13:36:27 GMT

It appears a regression has crept in since the 3.3G community release. The passthru SSO configuration has somehow got out of sync.

I logged and fixed

http://issues.alfresco.com/jira/browse/ALF-3737

I have added a unit test so that this will not be a problem in the future.

So you can either build from the latest code on HEAD or a workaround is to simply copy

$TOMCAT_HOME/webapps/alfresco/WEB-INF/classes/alfresco/subsystems/Authentication/alfrescoNtlm/ntlm-filter-context.xml to

$TOMCAT_HOME/webapps/alfresco/WEB-INF/classes/alfresco/subsystems/Authentication/passthru/ntlm-filter-context.xml

Thanks.

Re: CIFS configuration error on ntlm / passthru / ldap-ad chain

david_labbe — Thu, 01 Jul 2010 15:02:00 GMT

Thanks David, it worked like a charm!

Re: CIFS configuration error on ntlm / passthru / ldap-ad chain

david_labbe — Thu, 01 Jul 2010 15:17:29 GMT

Maybe I spoke to quickly…

the fix works in the sense that I do not get the error previously encountered, and my log file does show that the CIFS server is started. However, I cannot access the CIFS shared drive anymore.

This is the error I now get:

17:08:17,857 DEBUG [org.alfresco.fileserver] Open authenticate session to [<myDomain>\<myWorkstation>:<myWorkstationIP>:Online:12,Thu Jul 01 17:08:06 CEST 2010]
17:08:18,063 DEBUG [org.alfresco.smb.protocol.auth] Passthru sessId=14, auth ctx=[NTLM,Challenge=813badbe08ee5f2e]
17:08:18,092 DEBUG [org.alfresco.smb.protocol.auth] Using Write transaction
17:08:18,105 ERROR [org.alfresco.smb.protocol.auth] org.alfresco.jlan.smb.SMBException: Logon failure‍‍‍‍

Any idea?

Thanks again for the help.

David

Re: CIFS configuration error on ntlm / passthru / ldap-ad chain

david_labbe — Thu, 01 Jul 2010 15:30:14 GMT

my bad, I had forgotten to update the file-servers-custom.xml file tom indicate that CIFS authentication was done using passthru:

      <!– CIFS authentication –>
      <!– Available types are 'alfresco', 'passthru' and 'enterprise' –>
      <authenticator type="passthru"/>
      
      <!– CIFS Passthru authentication sample –>
      <!– Also see the <DomainMappings> config in the 'Filesystem Security' section below –>
      <authenticator type="passthru">
        <Server><myDomain>\<myLdapServer></Server>
        <protocolOrder>TCPIP,NetBIOS</protocolOrder>
        <offlineCheckInterval>60</offlineCheckInterval>
      </authenticator>‍‍‍‍‍‍‍‍‍‍‍

Dop!

Thanks

David

Re: CIFS configuration error on ntlm / passthru / ldap-ad chain

david_labbe — Thu, 01 Jul 2010 15:52:14 GMT

Strangely enough, I can only access the CIFS "shared drive" if I use the IP address of the CIFS server (i.e. alfresco server). If i use the server name, then I get nowhere. The webclient works however without a glitch with the server name, i.e. : http://<myAflrescoServerName>:8080/alfresco

This was not an issue when I only used the alfrescoNtlm and ldap-ad authentication chain. Adding the passthru seems to have buggered something somewhere…

Any idea?

Cheers

David

Re: CIFS configuration error on ntlm / passthru / ldap-ad chain

dward — Thu, 01 Jul 2010 17:24:51 GMT

Why are you using file-servers-custom.xml? This file isn't used in Alfresco v3.2.

The up to date documentation is all here http://wiki.alfresco.com/wiki/Alfresco_Authentication_Subsystems. You shouldn't have to reconfigure the file servers at all for authentication. They now just react to what's in your authentication chain.

I think your log just shows that someone is failing to authenticate.

It may be that Windows has cached an invalid password for you against the alfresco server's real name. Remove any stored crendentials from the Windows Control Panel (its location varies depending on your Windows version so best to google that).

Putting this line in log4j.properties might reveal more information in the logs

log4j.logger.org.alfresco.smb.protocol.auth=debug

Check from a different client computer just to make sure it's nothing to do with one particular client.