topic Re: Authentication Chaining: using CIFS, with LDAP sync in Alfresco Archive

Authentication Chaining: using CIFS, with LDAP sync

petershine — Wed, 13 Jan 2010 15:30:14 GMT

I am currently building a cloud system allowing remote users to access hosted Alfresco.The most important feature in our my is using VPN allowing CIFS mapping for remote Windows users, not requiring them to use WebDAV.If I use only Alfresco NTLM authentication, regular web logging-in(Explorer and Sh

Re: Authentication Chaining: using CIFS, with LDAP sync

gronfelt — Thu, 14 Jan 2010 15:15:36 GMT

Is the problem that CIFS is not working with the password set in Alfresco?

The reason I'm asking is because in your question it seems that you wan't to authenticate your users with the password stored in LDAP, is that correct? If that's the case that is unfortunately not possible due to differences in the password hashing.

Re: Authentication Chaining: using CIFS, with LDAP sync

dward — Thu, 14 Jan 2010 16:21:32 GMT

It should be possible to use the passthru subsystem in your authentication chain to authenticate against Samba. See

http://forums.alfresco.com/en/viewtopic.php?f=9&t=21091

Re: Authentication Chaining: using CIFS, with LDAP sync

petershine — Fri, 15 Jan 2010 01:17:11 GMT

Is the problem that CIFS is not working with the password set in Alfresco?
The reason I'm asking is because in your question it seems that you wan't to authenticate your users with the password stored in LDAP, is that correct? If that's the case that is unfortunately not possible due to differences in the password hashing.

Thank you for your quick reply and pointing out the important matter.
I've done more after submitting the post, trying to understand Authentication limitations.
And as you've wanted to confirmed, the issue was about using One ID and Password stored in LDAP, which is not possible for Alfresco (without an extra tuning?).

I've found out that it's possible to have identical username with the different space name, virtually allowing the user to have 2 kinds of password for CIFS access and LDAP authentication. However, this kind of walkaround is totally against the very intention of adopting LDAP.

After you've posted, an Alfresco Engineer "dward: http://forums.alfresco.com/en/viewtopic.php?f=9&t=24294#p79395" posted:

"It should be possible to use the passthru subsystem in your authentication chain to authenticate against Samba. See http://forums.alfresco.com/en/viewtopic.php?f=9&t=21091

I think there's an answer I'm looking for.

Re: Authentication Chaining: using CIFS, with LDAP sync

petershine — Fri, 15 Jan 2010 01:19:15 GMT

It should be possible to use the passthru subsystem in your authentication chain to authenticate against Samba. See

http://forums.alfresco.com/en/viewtopic.php?f=9&t=21091

Thank you, I'll carefully look into it.