topic Alfresco Share 3.2 NTLM SSO fails in Alfresco Archive

Alfresco Share 3.2 NTLM SSO fails

ofrxnz — Wed, 08 Jul 2009 14:46:23 GMT

So, i have configured Alfresco proper to use NTLM SSO against a windows 2k3 R2 Active directory server. everything is working well. I followed the instructions here http://wiki.alfresco.com/wiki/Alfresco_Authentication_Subsystemsbut when i tried to switch Share over to use SSO against passthru/ntl

Re: Alfresco Share 3.2 NTLM SSO fails

jtp — Wed, 08 Jul 2009 15:27:05 GMT

I have this exact same issue. I'm using passthru with NTLM based SSO. Did you notice how it authenticates the user successfully, then switches to guest, then errors out because guest isn't allowed?

/alfresco interface SSO is working fine. If I roll back the Share SSO customizations, manual authentication works.

Re: Alfresco Share 3.2 NTLM SSO fails

ofrxnz — Wed, 08 Jul 2009 15:36:00 GMT

Yeah, i saw that. I wonder what it would do if guest access was allowed to the system? I wish it would say which script it is (or if i could find /alfresco/wcs/webframework/content/metadata )

the mobile.war system seems to be giving the same error but i think its chained into Share. So, one problem at a time

Re: Alfresco Share 3.2 NTLM SSO fails

pbkoob — Fri, 10 Jul 2009 13:23:04 GMT

Just out of curiosity, how did you set up NTLM? I set it up as passthru

authentication.chain=passthru1assthru

going through local server

passthru.authentication.useLocalServer=true

It generated a bunch of error in the alfresco.log (see below) that I think correspond to every time someone logs in. The errors seem to be in pairs. I changed the settings in the subsystems to not enable SSO login and I still got the errors, but I could login. I wonder if the issues is not so much with SSO as it is with passthru (assuming that is what you are using.)

org.alfresco.repo.security.authentication.AuthenticationException: 06090003 Guest authentication not supported
   at org.alfresco.repo.security.authentication.AbstractChainingAuthenticationService.authenticateAsGuest(AbstractChainingAuthenticationService.java:196)
   at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
   at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
   at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
   at java.lang.reflect.Method.invoke(Method.java:597)
   at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:304)
   at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:182)
   at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:149)
   at net.sf.acegisecurity.intercept.method.aopalliance.MethodSecurityInterceptor.invoke(MethodSecurityInterceptor.java:80)
   at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:171)
   at org.alfresco.repo.security.permissions.impl.ExceptionTranslatorMethodInterceptor.invoke(ExceptionTranslatorMethodInterceptor.java:49)
   at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:171)
   at org.alfresco.repo.audit.AuditComponentImpl.audit(AuditComponentImpl.java:275)
   at org.alfresco.repo.audit.AuditMethodInterceptor.invoke(AuditMethodInterceptor.java:69)
   at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:171)
   at org.springframework.transaction.interceptor.TransactionInterceptor.invoke(TransactionInterceptor.java:106)
   at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:171)
   at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:204)
   at $Proxy26.authenticateAsGuest(Unknown Source)
   at org.alfresco.repo.web.scripts.servlet.BasicHttpAuthenticatorFactory$BasicHttpAuthenticator.authenticate(BasicHttpAuthenticatorFactory.java:127)
   at org.alfresco.repo.web.scripts.RepositoryContainer.executeScript(RepositoryContainer.java:280)
   at org.alfresco.web.scripts.AbstractRuntime.executeScript(AbstractRuntime.java:262)
   at org.alfresco.web.scripts.AbstractRuntime.executeScript(AbstractRuntime.java:139)
   at org.alfresco.web.scripts.servlet.WebScriptServlet.service(WebScriptServlet.java:122)
   at javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
   at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
   at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
   at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
   at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
   at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128)
   at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
   at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
   at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:286)
   at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:845)
   at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:583)
   at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:447)
   at java.lang.Thread.run(Thread.java:619)
10:01:09,182 ERROR [org.alfresco.web.scripts.AbstractRuntime] Exception from executeScript - redirecting to status template error: 06090006 Login failed
org.alfresco.web.scripts.WebScriptException: 06090006 Login failed
   at org.alfresco.repo.web.scripts.bean.AbstractLoginBean.login(AbstractLoginBean.java:81)
   at org.alfresco.repo.web.scripts.bean.LoginPost.executeImpl(LoginPost.java:79)
   at org.alfresco.web.scripts.DeclarativeWebScript.executeImpl(DeclarativeWebScript.java:223)
   at org.alfresco.web.scripts.DeclarativeWebScript.execute(DeclarativeWebScript.java:70)
   at org.alfresco.repo.web.scripts.RepositoryContainer$2.execute(RepositoryContainer.java:357)
   at org.alfresco.repo.transaction.RetryingTransactionHelper.doInTransaction(RetryingTransactionHelper.java:326)
   at org.alfresco.repo.web.scripts.RepositoryContainer.transactionedExecute(RepositoryContainer.java:407)
   at org.alfresco.repo.web.scripts.RepositoryContainer.transactionedExecuteAs(RepositoryContainer.java:424)
   at org.alfresco.repo.web.scripts.RepositoryContainer.executeScript(RepositoryContainer.java:253)
   at org.alfresco.web.scripts.AbstractRuntime.executeScript(AbstractRuntime.java:262)
   at org.alfresco.web.scripts.AbstractRuntime.executeScript(AbstractRuntime.java:139)
   at org.alfresco.web.scripts.servlet.WebScriptServlet.service(WebScriptServlet.java:122)
   at javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
   at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
   at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
   at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
   at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
   at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128)
   at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
   at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
   at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:286)
   at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:845)
   at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:583)
   at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:447)
   at java.lang.Thread.run(Thread.java:619)‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Re: Alfresco Share 3.2 NTLM SSO fails

jtp — Fri, 10 Jul 2009 14:42:41 GMT

I've got uselocalserver to false because i'm listing the servers (with various combinations of domains and servers).

I'm also getting tons of errors about logins and authentication, even when logins are working.

Re: Alfresco Share 3.2 NTLM SSO fails

jtp — Mon, 13 Jul 2009 17:05:04 GMT

Anyone have any ideas?

Re: Alfresco Share 3.2 NTLM SSO fails

dward — Mon, 13 Jul 2009 17:22:17 GMT

I'm afraid this is a known issue with the 3.2 Community release.

See

https://issues.alfresco.com/jira/browse/ETHREEOH-2384

Just to summarise, there are problems enabling NTLM SSO for the share app. The alfresco app should be OK.

I expect to investigate and update this forum in the near future.

Re: Alfresco Share 3.2 NTLM SSO fails

jtp — Mon, 13 Jul 2009 17:28:40 GMT

I saw that in JIRA and was afraid it was the same issue. I'm already watching that one. If I can provide any information about my configuration to help troubleshoot, let me know.

Re: Alfresco Share 3.2 NTLM SSO fails

gsoalheiro — Wed, 05 Aug 2009 04:00:51 GMT

Any ideas when we can expect this 'major' bug, as its been prioritised in the JIRA, will be resolved?

Re: Alfresco Share 3.2 NTLM SSO fails

kevinr — Wed, 05 Aug 2009 10:43:44 GMT

I have raised the priority of the bug. It will be fixed during the current 3.2 bug fixing phase, i will post the diff if possible once it is fixed.

Kev

Re: Alfresco Share 3.2 NTLM SSO fails

gsoalheiro — Thu, 06 Aug 2009 06:01:36 GMT

Thanks Kev. Are there any timeframes available for the current 3.2 bug fixing phase?

Re: Alfresco Share 3.2 NTLM SSO fails

dward — Mon, 17 Aug 2009 10:34:16 GMT

I have found a fix. You just need to edit webscript-framework-config-custom.xml as follows:


   <config evaluator="string-compare" condition="Remote">
      <remote>
         
         <connector>
            <id>alfrescoCookie</id>
            <name>Alfresco Connector</name>
            <description>Connects to an Alfresco instance using cookie-based authentication</description>
            <class>org.alfresco.connector.AlfrescoConnector</class>
         </connector>

         <endpoint>
            <id>alfresco</id>
            <name>Alfresco - user access</name>
            <description>Access to Alfresco Repository WebScripts that require user authentication</description>
            <connector-id>alfrescoCookie</connector-id>
            <endpoint-url>http://localhost:8080/alfresco/wcs</endpoint-url>
            <identity>user</identity>
            <external-auth>true</external-auth>
         </endpoint>
         
      </remote>
   </config>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

I have updated the .sample file and Wiki

http://wiki.alfresco.com/wiki/Alfresco_Authentication_Subsystems#Alfresco_Share_SSO_using_NTLM

Re: Alfresco Share 3.2 NTLM SSO fails

kevinr — Mon, 17 Aug 2009 10:52:24 GMT

I have tested the fix locally, it works for me. Thanks David for that.

Cheers,

Kev

Re: Alfresco Share 3.2 NTLM SSO fails

ivan_plestina — Mon, 17 Aug 2009 12:15:09 GMT

Kevin, David,

This breaks existing sites. Clicking on link to any existing site just redirects back to user dashboard. Newly created sites work fine. Any advice?

EDIT: After relogging couple of hours later that newly created site is dead too. No error in logs.

Re: Alfresco Share 3.2 NTLM SSO fails

kevinr — Mon, 17 Aug 2009 12:28:59 GMT

Can i suggest you clear all session data from the browser etc. and any saved sessions in TomCat. There is no difference between "existing" and "new" sites as far as authentication is concerned.

Anyone else given this fix a try?

Thanks,

Kev

Re: Alfresco Share 3.2 NTLM SSO fails

ivan_plestina — Mon, 17 Aug 2009 12:35:11 GMT

Cleared cookies, restarted browser, restarted tomcat, cleaned tomcat temp files….same thing in both FF and IE. Another user reported the same thing in JIRA.

Re: Alfresco Share 3.2 NTLM SSO fails

kevinr — Mon, 17 Aug 2009 12:56:52 GMT

Indeed they did - but this is really about fixing the NTLM issue, nothing else. The other issue is still being investigated. AFAIK this fixes the NTLM issue, i have still not seen the other issue myself yet nor investigated it.

Kevin

Re: Alfresco Share 3.2 NTLM SSO fails

ivan_plestina — Mon, 17 Aug 2009 14:06:59 GMT

I believe creating site and then restarting tomcat (or just share application) should trigger this bug.

Re: Alfresco Share 3.2 NTLM SSO fails

dward — Tue, 18 Aug 2009 18:15:28 GMT

Thanks. Enabling SSO and restarting tomcat after creating a site was indeed a very good way of reproducing the issue reported in

http://forums.alfresco.com/en/viewtopic.php?f=47&t=20428&p=69304#p69304

We now have a solution to the problem. Please see the above thread. And can I point out that this regression was nothing to do with the refactoring of the authentication subsystems!

Re: Alfresco Share 3.2 NTLM SSO fails

gotfredsen — Wed, 19 Aug 2009 14:06:34 GMT

Yes, it works for me too. Thanks

I suggest you change the wiki from "uncomment this section" to "cut and past this section".

Thanks again,
Bjarke