topic Re: Basic SSO and NTLM help, please... Getting frustrated... in Alfresco Archive

Basic SSO and NTLM help, please... Getting frustrated...

deaconboogie — Tue, 14 Jul 2009 17:15:41 GMT

This is really wearing me down… :shock: I'm using 3.2 and have read http://wiki.alfresco.com/wiki/Alfresco_Authentication_Subsystems pretty heavily, and I still can't seem to get this to work correctly.All I want to do is the following:1. User visits an Alfresco page and based on the logged in doma

Re: Basic SSO and NTLM help, please... Getting frustrated...

dward — Tue, 14 Jul 2009 17:26:18 GMT

Try this

passthru.authentication.domain=
passthru.authentication.servers=MYDOMAIN\\dc.mydomain.local,dc.mydomain.local

Don't use the userLocalServer, domain or servers properties at the same time. They are mutually exclusive. If you set domain, it will try to work out your domain server from the domain name. It's most reliable to list the servers explicitly as above. Include a server without a domain mapping as a 'fallback' when no domain is specified in the authentication request.

Re: Basic SSO and NTLM help, please... Getting frustrated...

deaconboogie — Tue, 14 Jul 2009 17:43:57 GMT

Try this

Trying… Alfresco sure takes a long time to start. Close to five minutes. It makes testing changes that much more painful…

What kind of hoops am I going to go through to get Share working with this? I read in another thread that NTLM is broken with 3.2?

Re: Basic SSO and NTLM help, please... Getting frustrated...

dward — Tue, 14 Jul 2009 17:46:14 GMT

Well in the upcoming enterprise version you can edit these settings using Jconsole without restarting the entire system but I guess that's no consolation.

We expect to have a fix for Share NTLM very soon.

Re: Basic SSO and NTLM help, please... Getting frustrated...

deaconboogie — Tue, 14 Jul 2009 17:48:03 GMT

Try this

No dice. Same problem as before.

BTW: I am sure that NTLM is enabled and the URL is in my intranet site list.

How can I enable some form of debugging for the authentication so I can see what possible issue it is having?

Re: Basic SSO and NTLM help, please... Getting frustrated...

dward — Tue, 14 Jul 2009 17:50:58 GMT

Same problem as before what?

Re: Basic SSO and NTLM help, please... Getting frustrated...

dward — Tue, 14 Jul 2009 17:52:29 GMT

Oh I see. Please forgive me. I re-read the original post. Have an idea…

Re: Basic SSO and NTLM help, please... Getting frustrated...

dward — Tue, 14 Jul 2009 17:55:42 GMT

In the authentication subsystems wiki, it explains that SSO and CIFS authentication cannot be chained. You have two SSO-capable subsystems in your chain

authentication.chain=alfrescoNtlm1:alfrescoNtlm,passthru1assthru

therefore the first enabled one in the chain (alfrescoNtlm1) will do the SSO authentication.

Probably best to take alfresco out the chain

authentication.chain=passthru1assthru

Or if you really do want Alfresco internal users to be able to log in as well as domain users, you are going to have to switch off sso.enabled on both subsystems.

This is a limitation imposed on us by the NTLM negotiation mechanism.

Re: Basic SSO and NTLM help, please... Getting frustrated...

deaconboogie — Tue, 14 Jul 2009 18:12:32 GMT

In the authentication subsystems wiki, it explains that SSO and CIFS authentication cannot be chained. You have two SSO-capable subsystems in your chain

authentication.chain=alfrescoNtlm1:alfrescoNtlm,passthru1assthru

Okay, that makes sense… I was going off of the example that seemed to describe what I want at first glance. I probably misread it in the panic.

The fact that it's called "alfrescoNtml" when it may or may not have anything to do with NTLM may have thrown me off… I mean, if it says NTLM and it has to do with the local Alfresco user database, in the context of creating local users with matching password hashes, it seems confusing. And even my just-stated understanding may be grossly inaccurate.

The chain modification above seems to work. However… I found another somewhat disturbing issue:

It looks like all three variations of the login/credentials work (user@domain, domain\user, user)

Notice my passthru.authentication.defaultAdministratorUserNames contains just "administrator". When I log in as administrator@domain or domain\administrator, I do not receive the administrative icon in the toolbar. When I log in as just "administrator", I do get the admin icon.

Won't this cause issues if the user is not using NTLM and has to type their credentials?

Re: Basic SSO and NTLM help, please... Getting frustrated...

_sax — Wed, 15 Jul 2009 15:45:24 GMT

I'm trying to understand SSO systems right.
I try to use ldap sync and therefore use ldap-ad as second part of my authentication chain. To log the synced users in, I use passthru with SSO and CIFS enabled. This is working good. But I still would like to be able to use the internal guest account for webscripts or what may come.
So my requirements are: syncing from ldap-ad, sso through browser, cifs and having a guest account.
If I add alfrescoNtlm to the authentication chain I'm either able to login by SSO as 'me', but having no guest account (log saying '[org.alfresco.web.app.servlet.NTLMAuthenticationFilter] Authentication failed, 06150006 Account disabled' when trying to manually sign on as guest) or having a usable guest account, which is auto-signing me on regardless of my real username.
Is this a NTLM-limitation, or did I do something wrong? I tested almost every combination in the authentication chain and of the true/false options that come with the subsystems.

Thanks a lot for the clarifying statements in this forum!

Re: Basic SSO and NTLM help, please... Getting frustrated...

dward — Wed, 15 Jul 2009 16:42:31 GMT

It would appear that guest logons are validated against the back-end domain server. So you would have to actually enable the domain guest account to enable guest logins using passthru.

Re: Basic SSO and NTLM help, please... Getting frustrated...

_sax — Wed, 15 Jul 2009 17:14:42 GMT

Okay, thank you! I checked webscripts, and they are working, even though I'm not able to login manually as guest. So all is well

Re: Basic SSO and NTLM help, please... Getting frustrated...

wiz561 — Fri, 27 Aug 2010 16:48:49 GMT

OK, I have a similar situation. Bottom line is that I got the web authentication working by using the information in this post.

I'm having a problem with trying to authenticate with my AD credentials to the cifs share. I can login to the share using the local default admin/admin username and password, but can't use my AD credentials.

I have a feeling that I didn't set an option up properly. Can somebody assist in giving a hint on how to accomplish this?