CIFS/SMB on Windows w/ 3.2

jimbojw — Thu, 13 Aug 2009 17:44:57 GMT

Hi all,I'm trying to do something which should be simple (I think). I'm trying to set up a stock Alfresco 3.2 (community) server on a Windows Server 2003 host with CIFS/SMB support. These are the customizations that I've added to the alfresco-global.properties file:## CIFS#————-cifs.enabled=trueci

Re: CIFS/SMB on Windows w/ 3.2

ivan_plestina — Mon, 17 Aug 2009 07:51:27 GMT

NTLM passthru + ldap sync + TCP/IP SMB working config (apart from office 2007 over cifs messing things up -> https://issues.alfresco.com/jira/browse/ETHREEOH-2320😞

NOTE: Use latest nightly build that includes fixes for 3.2 community!

alfresco-global.properties:

authentication.chain=passthru1:passthru,ldap-ad1:ldap-ad‍

C:\Alfresco\tomcat\shared\classes\alfresco\extension\subsystems\fileServers\default\default\changes.properties:

#
# File Server Subsystem
#
filesystem.name=Alfresco
filesystem.domainMappings=DOMAIN
filesystem.domainMappings.value.DOMAIN.rangeFrom=172.16.1.0
filesystem.domainMappings.value.DOMAIN.rangeTo=172.16.1.255

cifs.enabled=true
cifs.localname=ALFRESCO
cifs.domain=DOMAIN
cifs.hostannounce=true
cifs.urlfile.prefix=http://alfresco:8080/alfresco/

cifs.broadcast=172.16.1.255
cifs.bindto=172.16.1.45
cifs.ipv6=disabled
#cifs.disableNativeCode=true

ftp.enabled=false
ftp.ipv6=disabled
nfs.enabled=false
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

C:\Alfresco\tomcat\shared\classes\alfresco\extension\subsystems\fileServers\default\default\custom-file-servers-context.xml:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE beans PUBLIC "-//SPRING/DTD BEAN//EN"
    "http://www.springframework.org/dtd/spring-beans.dtd">
<beans>

   <bean id="fileServerConfiguration" class="org.alfresco.filesys.config.ServerConfigurationBean" parent="fileServerConfigurationBase">
      <property name="cifsConfigBean">
         <ref bean="cifsServerConfig" />
      </property>
      <property name="ftpConfigBean">
         <ref bean="ftpServerConfig" />
      </property>
      <property name="nfsConfigBean">
         <ref bean="nfsServerConfig" />
      </property>
      <property name="filesystemContexts">
         <ref bean="filesystemContexts" />
      </property>
      <property name="securityConfigBean">
         <ref bean="fileSecurityConfig" />
      </property>
   </bean>

   <!– CIFS Server –>

   <bean id="cifsServer" class="org.alfresco.filesys.CIFSServerBean" destroy-method="stopServer">
      <constructor-arg>
         <ref local="fileServerConfiguration" />
      </constructor-arg>
      <property name="sessionListeners">
         <list>
            <!– Allow authentication subsystem to listen for SMB sessions, e.g. for passthru –>
            <ref bean="SmbSessionListener" />
         </list>
      </property>
   </bean>

   <!– FTP Server –>

   <bean id="ftpServer" class="org.alfresco.filesys.FTPServerBean" destroy-method="stopServer">
      <constructor-arg>
         <ref local="fileServerConfiguration" />
      </constructor-arg>
   </bean>

   <!– NFS Server –>

   <bean id="nfsServer" class="org.alfresco.filesys.NFSServerBean" destroy-method="stopServer">
      <constructor-arg>
         <ref local="fileServerConfiguration" />
      </constructor-arg>
   </bean>

   <!–  JMX Monitoring –>

   <bean id="FileServerConfig" class="org.alfresco.filesys.FileServerConfig">
      <property name="fileServerConfiguration">
         <ref bean="fileServerConfiguration" />
      </property>
      <property name="ftpServer">
         <ref bean="ftpServer" />
      </property>
      <property name="cifsServer">
         <ref bean="cifsServer" />
      </property>
      <property name="nfsServer">
         <ref bean="nfsServer" />
      </property>
   </bean>

   <bean id="cifsServerConfig" class="org.alfresco.filesys.config.CIFSConfigBean">
      <property name="serverEnabled">
         <value>${cifs.enabled}</value>
      </property>
      <property name="serverName">
         <value>${cifs.serverName}</value>
      </property>
      <property name="domainName">
         <value>${cifs.domain}</value>
      </property>
      <property name="serverComment">
         <value>Alfresco CIFS Server</value>
      </property>
      <!– Set to the broadcast mask for the subnet –>
      <property name="broadcastAddress">
         <value>${cifs.broadcast}</value>
      </property>
      <!– Set to the IP for the adapter for Java socket –>
      <property name="bindToAddress">
         <value>${cifs.bindto}</value>
      </property>
      <!– Use Java socket based NetBIOS over TCP/IP and native SMB on linux –>
      <property name="tcpipSMB">
         <bean class="org.alfresco.filesys.config.TcpipSMBConfigBean">
            <!–
               Can be mapped to non-privileged ports, then use firewall rules to forward requests from the standard
               ports
            –>
            <property name="port">
               <value>${cifs.tcpipSMB.port}</value>
            </property>
            <property name="ipv6Enabled">
               <value>${cifs.ipv6.enabled}</value>
            </property>
         </bean>
      </property>
<!–
      <property name="netBIOSSMB">
         <bean class="org.alfresco.filesys.config.NetBIOSSMBConfigBean">
            <property name="bindTo">
               <value>${cifs.bindto}</value>
            </property>
            <property name="sessionPort">
               <value>${cifs.netBIOSSMB.sessionPort}</value>
            </property>
            <property name="namePort">
               <value>${cifs.netBIOSSMB.namePort}</value>
            </property>
            <property name="datagramPort">
               <value>${cifs.netBIOSSMB.datagramPort}</value>
            </property>
            <property name="platforms">
               <value>linux,solaris,macosx</value>
            </property>
         </bean>
      </property>
–>
      <property name="hostAccouncerEnabled">
         <value>${cifs.hostannounce}</value>
      </property>
      <property name="hostAccounceInterval">
         <value>5</value>
      </property>

      <!– Use Win32 NetBIOS interface on Windows –>
<!–
      <property name="win32NetBIOS">
         <bean class="org.alfresco.filesys.config.Win32NetBIOSConfigBean" />
      </property>
      <property name="win32HostAnnouncerEnabled">
         <value>${cifs.hostannounce}</value>
      </property>
      <property name="win32HostAnnounceInterval">
         <value>5</value>
      </property>
–>

      <!– CIFS authentication –>
      <property name="authenticator">
         <ref bean="CifsAuthenticator" />
      </property>

      <!– Disable the use of asynchronous sockets/NIO code –>
      <property name="disableNIO">
         <value>${cifs.disableNIO}</value>
      </property>

      <!– Disable the use of JNI code –>
      <!– Only currently affects Windows –>
      <property name="disableNativeCode">
         <value>${cifs.disableNativeCode}</value>
      </property>

      <!– Session timeout, in seconds –>
      <!– Defaults to 15 minutes, to match the default Windows client setting        –>
      <!– If no I/O is received within that time the session is closed by the server –>
      <property name="sessionTimeout">
         <value>${cifs.sessionTimeout}</value>
      </property>

      <!– Enable WINS if used for NetBIOS name lookups –>
      <property name="WINSConfig">
         <bean class="org.alfresco.filesys.config.WINSConfigBean">
            <property name="autoDetectEnabled">
               <value>${cifs.WINS.autoDetectEnabled}</value>
            </property>
            <property name="primary">
               <value>${cifs.WINS.primary}</value>
            </property>
            <property name="secondary">
               <value>${cifs.WINS.secondary}</value>
            </property>
         </bean>
      </property>

      <!–
      <property name="sessionDebugFlags"> <value>Negotiate,Socket</value> </property>
      –>
   </bean>

   <bean id="ftpServerConfig" class="org.alfresco.filesys.config.FTPConfigBean">
      <property name="serverEnabled">
         <value>${ftp.enabled}</value>
      </property>

      <property name="port">
         <value>${ftp.port}</value>
      </property>

      <!– IPv6 support –>
      <property name="ipv6Enabled">
         <value>${ftp.ipv6.enabled}</value>
      </property>

      <!– FTP authentication –>
      <property name="authenticator">
         <ref bean="FtpAuthenticator" />
      </property>

      <!– FTP server debug settings –>
      <!– Enable 'log4j.logger.org.alfresco.fileserver=debug' in log4j.properties file –>
      <!–
         <property name="debugFlags"> <value>File,Search,Error,Directory,Info,DataPort</value> </property>
      –>

   </bean>

   <!–The configurable RPC user mappings - actually a post-processed composite property! –>
   <bean id="nfs.user.mappings" class="org.springframework.beans.factory.config.ListFactoryBean">
      <property name="sourceList">
         <list>
            <bean class="org.alfresco.filesys.auth.nfs.UserMapping">
               <property name="beanName">
                  <value>${alfresco_user_store.adminusername}</value>
               </property>
               <property name="uid">
                  <value>0</value>
               </property>
               <property name="gid">
                  <value>0</value>
               </property>
            </bean>
         </list>
      </property>
   </bean>

   <bean id="nfsServerConfig" class="org.alfresco.filesys.config.NFSConfigBean">
      <property name="serverEnabled">
         <value>${nfs.enabled}</value>
      </property>

      <!– Map NFS user/group ids to Alfresco users –>
      <property name="rpcAuthenticator">
         <bean class="org.alfresco.filesys.auth.nfs.AlfrescoRpcAuthenticator">
            <property name="userMappings">
               <ref bean="nfs.user.mappings" />
            </property>
         </bean>
      </property>
   </bean>

   <bean id="filesystemContexts" class="org.springframework.beans.factory.config.ListFactoryBean">
      <property name="sourceList">
         <list>
            <!– Alfresco repository access shared filesystem –>
            <bean class="org.alfresco.filesys.repo.ContentContext">
               <property name="deviceName">
                  <value>${filesystem.name}</value>
               </property>
               <property name="storeName">
                  <value>${spaces.store}</value>
               </property>
               <property name="rootPath">
                  <value>/${spaces.company_home.childname}</value>
               </property>
               <!– Add a URL file to each folder that links back to the web client –>
               <property name="URLFileName">
                  <value>__Alfresco.url</value>
               </property>
               <property name="URLPrefix">
                  <value>${cifs.urlfile.prefix}</value>
               </property>
               <!– Mark locked files as offline –>
               <property name="offlineFiles">
                  <value>true</value>
               </property>

               <!– Desktop actions –>
               <!– Uses a client-side application to trigger a server-side action                         –>
               <!–   Echo - displays a message echoed from the server                                     –>
               <!–   URL  - launches a URL via the Windows shell                                          –>
               <!–   CmdLine - launches the Notepad application                                           –>
               <!–   CheckInOut - checks files in/out, drag and drop files onto the application           –>
               <!–   JavaScript - run a server-side script                                                –>
               <!–   JavaScriptURL - server-side script that generates a URL to the folder using a ticket –>
               <!–                   to avoid having to logon                                             –>
               <property name="globalDesktopActionConfig">
                  <bean class="org.alfresco.filesys.config.GlobalDesktopActionConfigBean">
                     <property name="path">
                        <value>alfresco/desktop/Alfresco.exe</value>
                     </property>
                     <property name="webpath">
                        <value>${cifs.urlfile.prefix}</value>
                     </property>
                  </bean>
               </property>
               <property name="desktopActionList">
                  <list>
                     <bean class="org.alfresco.filesys.repo.desk.CheckInOutDesktopAction">
                        <property name="name">
                           <value>CheckInOut</value>
                        </property>
                        <property name="filename">
                           <value>__CheckInOut.exe</value>
                        </property>
                     </bean>
                     <bean class="org.alfresco.filesys.repo.desk.JavaScriptDesktopAction">
                        <property name="name">
                           <value>JavaScriptURL</value>
                        </property>
                        <property name="filename">
                           <value>__ShowDetails.exe</value>
                        </property>
                        <property name="scriptName">
                           <value>alfresco/desktop/showDetails.js</value>
                        </property>
                        <property name="attributeList">
                           <value>anyFiles</value>
                        </property>
                        <property name="preprocess">
                           <value>copyToTarget</value>
                        </property>
                     </bean>
                     <!– Other desktop actions which may be enabled –>
                     <!–
                        <bean class="org.alfresco.filesys.repo.desk.EchoDesktopAction"> <property name="name">
                        <value>Echo</value> </property> <property name="filename"> <value>__AlfrescoEcho.exe</value>
                        </property> </bean> <bean class="org.alfresco.filesys.repo.desk.URLDesktopAction"> <property
                        name="name"> <value>URL</value> </property> <property name="filename">
                        <value>__AlfrescoURL.exe</value> </property> </bean> <bean
                        class="org.alfresco.filesys.repo.desk.CmdLineDesktopAction"> <property name="name">
                        <value>CmdLine</value> </property> <property name="filename"> <value>__AlfrescoCmd.exe</value>
                        </property> </bean> <bean class="org.alfresco.filesys.repo.desk.JavaScriptDesktopAction">
                        <property name="name"> <value>JavaScript</value> </property> <property name="filename">
                        <value>__AlfrescoScript.exe</value> </property> <property name="scriptName">
                        <value>alfresco/desktop/dumpRequest.js</value> </property> <property name="attributeList">
                        <value>anyFiles, multiplePaths, allowNoParams</value> </property> <property name="preprocess">
                        <value>confirm, copyToTarget</value> </property> </bean>
                     –>
                  </list>
               </property>
               <!– Additional access control of the filesystem –>
               <!– Access type of 'none' will stop the filesystem from showing up for that user/address/protocol –>
               <!–
                  <property name="accessControl"> <bean class="org.alfresco.filesys.config.acl.AccessControlListBean">
                  <property name="defaultAccessLevel"> <value>Write</value> </property> </bean> </property>
               –>
            </bean>
            <!– AVM virtualization view of all stores/versions for WCM –>
            <!– virtual view stores filter can be any of the following: normal, site, staging, author, preview –>
            <bean class="org.alfresco.filesys.avm.AVMContext">
               <property name="deviceName">
                  <value>AVM</value>
               </property>
               <property name="virtualView">
                  <value>true</value>
               </property>
               <property name="stores">
                  <value>site,staging,author</value>
               </property>
            </bean>
         </list>
      </property>
   </bean>

   <!–Configurable global ACLS - actually post-processed composite properties –>
   <bean id="filesystem.acl.global.domainAccessControls" class="org.springframework.beans.factory.config.ListFactoryBean" />

   <bean id="filesystem.acl.global.protocolAccessControls" class="org.springframework.beans.factory.config.ListFactoryBean" />

   <bean id="filesystem.acl.global.userAccessControls" class="org.springframework.beans.factory.config.ListFactoryBean" />

   <!– Domain mappings used for passthru authentication routing –>
   <!– Used when the client does not provide a domain name in the NTLM logon –>
   <bean id="filesystem.domainMappings" class="org.springframework.beans.factory.config.ListFactoryBean" />

   <bean id="fileSecurityConfig" class="org.alfresco.filesys.config.SecurityConfigBean">
      <property name="domainMappings">
         <ref bean="filesystem.domainMappings" />
      </property>

      <!– Custom share mapper when multi-tenancy is enabled –>
      <!–
         <property name="shareMapper"> <bean class="org.alfresco.filesys.alfresco.MultiTenantShareMapper"> <property
         name="serverConfiguration"> <ref bean="fileServerConfiguration" /> </property> <property name="debug">
         <value>true</value> </property> </bean> </property>
      –>

      <!– Global access control list                                                                    –>
      <!– Applied to all filesystems that do not have an accessControl property                         –>
      <property name="globalAccessControl">
         <bean class="org.alfresco.filesys.config.acl.AccessControlListBean">
            <!– Access type of 'none' will stop the filesystem from showing up for that user/address/protocol –>
            <property name="defaultAccessLevel">
               <value>${filesystem.acl.global.defaultAccessLevel}</value>
            </property>
            <property name="domainAccessControls">
               <ref bean="filesystem.acl.global.domainAccessControls" />
            </property>
            <property name="protocolAccessControls">
               <ref bean="filesystem.acl.global.protocolAccessControls" />
            </property>
            <property name="userAccessControls">
               <ref bean="filesystem.acl.global.userAccessControls" />
            </property>
         </bean>
      </property>
   </bean>

</beans>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

C:\Alfresco\tomcat\shared\classes\alfresco\extension\subsystems\Authentication\passthru\passthru1\changes.properties:

passthru.authentication.useLocalServer=false
passthru.authentication.servers=DOMAIN\\172.16.1.12,DOMAIN\\172.16.1.21,172.16.1.12,172.16.1.21
#passthru.authentication.domain=DOMAIN
ntlm.authentication.sso.enabled=true
alfresco.authentication.allowGuestLogin=false
ntlm.authentication.mapUnknownUserToGuest=false
passthru.authentication.authenticateCIFS=true
passthru.authentication.authenticateFTP=false
passthru.authentication.guestAccess=false
passthru.authentication.defaultAdministratorUserNames=administrator,admin,someuser
‍‍‍‍‍‍‍‍‍‍‍

C:\Alfresco\tomcat\shared\classes\alfresco\extension\subsystems\Authentication\ldap-ad\ldap-ad1\changes.properties:

#
# LDAP Sync
#
# This flag enables use of this LDAP subsystem for authentication. It may be
# that this subsytem should only be used for synchronization, in which case
# this flag should be set to false.
ldap.authentication.active=false
ldap.authentication.java.naming.security.authentication=simple

# This flag enables use of this LDAP subsystem for user and group
# synchronization. It may be that this subsytem should only be used for 
# authentication, in which case this flag should be set to false.
ldap.synchronization.active=true
ldap.authentication.userNameFormat=%s
ldap.authentication.allowGuestLogin=true
ldap.authentication.java.naming.provider.url=ldap://domain.local:389

# The default principal to bind with (only used for LDAP sync). This should be a UPN or DN
ldap.synchronization.java.naming.security.principal=alfresco@domain.local

# The password for the default principal (only used for LDAP sync)
ldap.synchronization.java.naming.security.credentials=YourPassword

# If positive, this property indicates that RFC 2696 paged results should be
# used to split query results into batches of the specified size. This
# overcomes any size limits imposed by the LDAP server.
ldap.synchronization.queryBatchSize=1000

# The query to select all objects that represent the groups to import.
ldap.synchronization.groupQuery=(&(objectclass\=group)(memberOf\=cn\=Alfresco Groups,ou\=users,dc\=domain,dc\=local))

# The query to select objects that represent the groups to import that have changed since a certain time.
ldap.synchronization.groupDifferentialQuery=(&(objectclass\=group)(memberOf\=cn\=Alfresco Groups,ou\=users,dc\=domain,dc\=local)(!(modifyTimestamp<\={0})))

# The query to select all objects that represent the users to import.
ldap.synchronization.personQuery=(&(objectclass\=user)(|(memberOf\=CN\=GroupA,OU\=users,DC\=domain,DC\=local)(memberOf\=CN\=GroupB,OU\=users,DC\=domain,DC\=local))(userAccountControl\:1.2.840.113556.1.4.803\:\=512))

# The query to select objects that represent the users to import that have changed since a certain time.
ldap.synchronization.personDifferentialQuery=(&(objectclass\=user)(|(memberOf\=CN\=GroupA,OU\=users,DC\=domain,DC\=local)(memberOf\=CN\=GroupB,OU\=users,DC\=domain,DC\=local))(userAccountControl\:1.2.840.113556.1.4.803\:\=512)(!(modifyTimestamp<\={0})))

# The group search base restricts the LDAP group query to a sub section of tree on the LDAP server.
ldap.synchronization.groupSearchBase=dc\=domain,dc\=local

# The user search base restricts the LDAP user query to a sub section of tree on the LDAP server.
ldap.synchronization.userSearchBase=dc\=domain,dc\=local

# The name of the operational attribute recording the last update time for a group or user.
ldap.synchronization.modifyTimestampAttributeName=modifyTimestamp

# The timestamp format. Unfortunately, this varies between directory servers.
ldap.synchronization.timestampFormat=yyyyMMddHHmmss'.0Z'

# The attribute name on people objects found in LDAP to use as the uid in Alfresco
ldap.synchronization.userIdAttributeName=sAMAccountName

# The attribute on person objects in LDAP to map to the first name property in Alfresco
ldap.synchronization.userFirstNameAttributeName=givenName

# The attribute on person objects in LDAP to map to the last name property in Alfresco
ldap.synchronization.userLastNameAttributeName=sn

# The attribute on person objects in LDAP to map to the email property in Alfresco
ldap.synchronization.userEmailAttributeName=mail

# The attribute on person objects in LDAP to map to the organizational id  property in Alfresco
ldap.synchronization.userOrganizationalIdAttributeName=company

# The default home folder provider to use for people created via LDAP import
ldap.synchronization.defaultHomeFolderProvider=userHomesHomeFolderProvider

# The attribute on LDAP group objects to map to the gid property in Alfrecso
ldap.synchronization.groupIdAttributeName=cn

# The group type in LDAP
ldap.synchronization.groupType=group

# The person type in LDAP
ldap.synchronization.personType=user

# The attribute in LDAP on group objects that defines the DN for its members
ldap.synchronization.groupMemberAttributeName=member

synchronization.synchronizeChangesOnly=true
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Re: CIFS/SMB on Windows w/ 3.2

golden_eye — Wed, 19 Aug 2009 06:57:28 GMT

Hi i have the same problem,
do u know how to configure CIFS that alfresco server is seen in windows domain?
In path /opt/Alfresco/Alfresco-3.2/tomcat/shared/classes/alfresco/extension/subsystems/fileServers/default/default
in file-servers.properties i set cifs.localname,domain and broadcast and then i configure file-servers-custom.xml .
My cifs server is enable and i can work with it, but i dont know why i can't see server in domain?
What configuration is need to enable this?

Please some advise.
Thanks.

topic Re: CIFS/SMB on Windows w/ 3.2 in Alfresco Archive

CIFS/SMB on Windows w/ 3.2

Re: CIFS/SMB on Windows w/ 3.2

Re: CIFS/SMB on Windows w/ 3.2

Re: CIFS/SMB on Windows w/ 3.2

Re: CIFS/SMB on Windows w/ 3.2