topic Admin user? after ldap config in Alfresco Archive

Admin user? after ldap config

cgherardi — Thu, 17 Sep 2009 06:40:55 GMT

Hi all,I'm very new to Alfresco and trying to get it up and running for evaluation purposes, primarily for document management.This should be really simple - what should I see when i'm logged in as an administrator?1) admin/admin no longer works after configuring ldap, not to concerned provided I ca

Re: Admin user? after ldap config

dward — Thu, 17 Sep 2009 09:15:12 GMT

If you are logged in as an administrator, you'll see the "Admin Console" icon above the title bar near the right hand side, and from there you'll be able to manage system users and groups.

Once you are in as an administrator, you can make other users administrators by adding them to the ALFRESCO_ADMINISTRATORS group.

Re: Admin user? after ldap config

cgherardi — Fri, 18 Sep 2009 04:25:40 GMT

Ok, I dont appear to be an administrator, or at least the default admin names dont appear to have worked.

Any mysql magic hints to add me as an admin? I cant see a users or groups table in the database, but i'm sure i'm missing something.

Carl G

Re: Admin user? after ldap config

dward — Fri, 18 Sep 2009 09:06:32 GMT

Believe me it works for everyone else.

Is "carl gherardi" really the name you log in as? Make sure it matches exactly in the configuration

Re: Admin user? after ldap config

cgherardi — Mon, 21 Sep 2009 04:54:42 GMT

Believe me it works for everyone else.

Is "carl gherardi" really the name you log in as? Make sure it matches exactly in the configuration

Yes - positive.

So far i've tried:

passthru.authentication.defaultAdministratorUserNames=administrator,carl gherardi
passthru.authentication.defaultAdministratorUserNames=administrator,carl gherardi@domain
passthru.authentication.defaultAdministratorUserNames=administrator,carl\ gherardi
passthru.authentication.defaultAdministratorUserNames=administrator,carl\ gherardi@domain

Then thought it might be that i'm being authenticated by some other part of the auth chain, so I removed the default ntlm chain leaving me with:
authentication.chain=passthru1assthru,ldap1:ldap-ad

And went through the same sequence above:

ldap.authentication.defaultAdministratorUserNames=carl gherardi
ldap.authentication.defaultAdministratorUserNames=carl gherardi@domain
ldap.authentication.defaultAdministratorUserNames=carl\ gherardi
ldap.authentication.defaultAdministratorUserNames=carl\ gherardi

All with no luck so far.

I'm now thinking that perhaps we aren't re-writing cookies when I log in.

Re: Admin user? after ldap config

dward — Mon, 21 Sep 2009 08:42:37 GMT

You have to use the exact ID that you type into the login box. Or if you're using NTLM, it would be the Windows account ID.

Re: Admin user? after ldap config

cgherardi — Tue, 22 Sep 2009 07:55:42 GMT

You have to use the exact ID that you type into the login box. Or if you're using NTLM, it would be the Windows account ID.

I'm def using the exact login id, though the browser appears to be caching details. (Note: server and client are same machine - Ubuntu 904)

I'm attempting to login against a 2k3 domain

Auth chain currently looks like:
authentication.chain=passthru1assthru,ldap1:ldap-ad

I nuked the install and started again, and watched the ldap sync happen successfully so I'm pretty sure the auth details are all correct.

I have both:
passthru.authentication.defaultAdministratorUserNames=carl gherardi
ldap.authentication.defaultAdministratorUserNames=carl gherardi

In alfresco-global.properties (where i've been configuring everything)

I had no errors on initial login as myself, but after restarting tomcat and visiting the default page (no login prompt appeared) I received:


ERROR [org.alfresco.web.app.servlet.NTLMAuthenticationFilter] Failed to validate user Carl Gherardi
org.alfresco.repo.security.authentication.AuthenticationException: 08220004 Unable to validate ticket
        at org.alfresco.repo.security.authentication.AbstractChainingAuthenticationService.validate(AbstractChainingAuthenticationService.java:309)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
‍‍‍‍‍‍‍‍

Any help appreciated - can provide any info you need to help.

Thanks

Carl G

Re: Admin user? after ldap config

dward — Wed, 23 Sep 2009 07:48:04 GMT

The sync side working does not guarantee that the authentication side is configured correctly.

So you're using NTLM? In that case the admin user name will be your NT user ID and I hope LDAP sync has been configured with the sAMAccountName as the user ID attribute (this is the default for ldap-ad).
Looks like you have some old, invalid session cookies.

Please clear all your cookies, close all your browser instances and restart your browser (this is only sometimes necessary after reconfiguration of authentication).

Re: Admin user? after ldap config

dward — Wed, 23 Sep 2009 07:49:59 GMT

I note also that your user ID is "Carl Gherardi".

So please set

passthru.authentication.defaultAdministratorUserNames=Carl Gherardi

Re: Admin user? after ldap config

cgherardi — Thu, 24 Sep 2009 03:33:41 GMT

I note also that your user ID is "Carl Gherardi".

So please set

passthru.authentication.defaultAdministratorUserNames=Carl Gherardi

Gah! case sensitive.

FWIW, I was typing the password in as lower case, but the user object in AD is 'correctly' capitalised.

Does this qualify as a minor bug I should log?

Re: Admin user? after ldap config

dward — Thu, 24 Sep 2009 07:42:09 GMT

Yes, I think there is a minor bug here. The defaultAdministratorUserNames settings should take into account whether the case sensitive user names setting is on or off.