topic Re: Alfresco 3.2r2 and CAS with LDAP, SEVER: Error filterStart in Alfresco Archive

Alfresco 3.2r2 and CAS with LDAP, SEVER: Error filterStart

grupblau — Wed, 31 Mar 2010 15:44:01 GMT

Hi all,I installed Alfresco 3.2r2 and it works fine.Now I would like to authenticate users using an already up&running CAS server, wich retrives users from an LDAP server. I've setup it as said in http://wiki.alfresco.com/wiki/Central_Authentication_Service_Configuration, I'm not using mod_jk as

Re: Alfresco 3.2r2 and CAS with LDAP, SEVER: Error filterStart

grupblau — Wed, 31 Mar 2010 16:12:29 GMT

The problem is in the library keembay-alfresco-cas.jar, as if I comment
<filter-class>com.keembay.alfresco.web.app.servlet.CASAuthenticationFilter</filter-class>
and it's related lines, Alfresco starts fine.

So I get the sources and rebuild it using eclipse and Alfresco libs that I have, but I get the same result.

Re: Alfresco 3.2r2 and CAS with LDAP, SEVER: Error filterStart

broken — Wed, 21 Apr 2010 08:11:13 GMT

I've got the same problem with alfresco 3.3 and CAS.

Do you find the solution ?

Re: Alfresco 3.2r2 and CAS with LDAP, SEVER: Error filterStart

freddi — Fri, 23 Apr 2010 13:19:38 GMT

i think i have the same problem. ref:http://forums.alfresco.com/en/viewtopic.php?f=8&t=26429

does anyone have a running cas setup with version 3.3?

Re: Alfresco 3.2r2 and CAS with LDAP, SEVER: Error filterStart

freddi — Tue, 11 May 2010 09:35:09 GMT

my SSO with CAS is working now.
I have compiled mod_auth_Cas for my windows environtment like in this explanation
http://wiki.alfresco.com/wiki/Alfresco_With_mod_auth_cas
But now i'have the following problem:
Alfresco is renewing the ticket all the time. The only possibility to avoid high server load and working lags is to set the tickettimeout really high. But then you have the problem that a other user, wich is using the same machine and the same browser, have the user credentials of the last authed user. (until the ticket gets invalid)

Does someone othe have such a problem?

Re: Alfresco 3.2r2 and CAS with LDAP, SEVER: Error filterStart

pmminov — Mon, 31 May 2010 15:41:15 GMT

I got 3.2r working with CAS and using that keembay lib, where it does not work at all and produces that severe error is 3.3

Keembay lib failes because the alfresco-core-jar between 3.2r and 3.3 changed drastically, the class is missing this 2 classes:

import org.alfresco.config.ConfigService;
import org.alfresco.i18n.I18NUtil;

I would like to know if someone knows how to replace those imports in 3.3

Also I tried the auth_mod thing, but I can´t, I use tomcat and have SSL and CAS working with a self-signed cert so I'm pretty sure I should be able to skip some steps right? but I'm totally lost when the wiki starts to talk about tomcat mods… I really don't understand that guide, is not generic at all

Re: Alfresco 3.2r2 and CAS with LDAP, SEVER: Error filterStart

pcb — Fri, 04 Jun 2010 12:11:05 GMT

I got the same issue… CAS implementation is working with Alfresco 3.2.0 but not wih 3.2r2…

And I don't more understand wikiexplanation about mod_auth module :cry:

Re: Alfresco 3.2r2 and CAS with LDAP, SEVER: Error filterStart

ankit_yakkundi — Fri, 23 Jul 2010 04:10:49 GMT

Hi
I have installed Alfresco enterprise 3.2r. I have doubt where should i deploy the cas war file,in alfresco's tomcat or seperate tomcat bundle? i also want to know whether i have to install LDAP server also.

Can you please what all files i need to change, and how i can establish a connection between the CAS server and Alfresco.

My scenarios:
1) I am working with windows and not Linux. I deployed the cas-server-webapp-3.4.2.war file in a separate instance and it is working fine in browser, but there is no connection with alfresco here.

2) I deployed the cas-server-webapp-3.4.2.war in the Alfresco_home/webapps folder and it gives me a "Connection refused error in Tomcat console" as ("Connection refused: ldap://docs.cignex.com:10389")

I am referring to this link:
http://www.liferay.com/web/guest/community/wiki/-/wiki/Main/Full+Integration+-+Liferay,+Alfresco,+SSO+and+LDAP
http://liferay.cignex.com/palm_tree/0387/sso/alfresco/

Any kind of suggestions are welcome.

Thanks in advance.

Ankit

Re: Alfresco 3.2r2 and CAS with LDAP, SEVER: Error filterStart

gauchoproluanco — Wed, 11 Aug 2010 08:14:58 GMT

Hi Ankit, hi everybody!!!

I have an alfresco 3.2r and the cas-server-webapp-3.4.2. For developing and testing purposes you can have them in the same application server. In my case I have both in the webapps directory of the tomcat that comes with that distribution of alfresco.

The cas-server is working against an Active Directory. For doing this I have to change the deployerConfigContext.xml ($ALFRESCO_HOME$/tomcat/webapps/cas-server/WEB-INF/deployerConfigContext.xml) in this way:

<bean class="org.jasig.cas.authentication.handler.support.SimpleTestUsernamePasswordAuthenticationHandler" /> for 
<bean class="org.jasig.cas.adaptors.ldap.FastBindLdapAuthenticationHandler" >
               <property name="filter" value="%u@your.domain.com" />
               <property name="contextSource" ref="yourContextSource" />
               <property name="ignorePartialResultException" value="yes" />
            </bean>‍‍‍‍‍‍

<bean id="yourContextSource" class="org.springframework.ldap.core.support.LdapContextSource">
      <property name="urls">
         <list>
            <value>ldap://your.own.ad.ip:389</value>
         </list>
      </property>
      <property name="userDn" value="CN=xxxx,…,DC=your,DC=domain,DC=com"/>
      <property name="password" value="xxxx"/>
      <property name="baseEnvironmentProperties">
         <map>
            <entry>
               <key>
                  <value>java.naming.security.authentication</value>
               </key>
               <value>simple</value>
            </entry>
         </map>
      </property>
   </bean>‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

You also need to put in the classpath of the cas-server ($ALFRESCO_HOME$/tomcat/webapps/cas-server/WEB-INF/lib)the cas-server-support-ldap-3.4.2.jar. Now If you restart the application server you should be able to login in the cas-server application with your active directory users.

In the alfresco server you need to do the next changes in the application's descriptor (($ALFRESCO_HOME$/tomcat/webapps/alfresco/WEB-INF/web.xml):

<filter>
     <filter-name>CAS Filter</filter-name>
     <filter-class>edu.yale.its.tp.cas.client.filter.CASFilter</filter-class>
     <init-param>
      <param-name>edu.yale.its.tp.cas.client.filter.loginUrl</param-name>
      <param-value>https://hostname:8443/cas-server/login</param-value>
     </init-param>
     <init-param>
      <param-name>edu.yale.its.tp.cas.client.filter.validateUrl</param-name>
      <param-value>https://hostname:8443/cas-server/serviceValidate</param-value>
     </init-param>
     <init-param>
      <param-name>edu.yale.its.tp.cas.client.filter.serverName</param-name>
      <param-value>hostname:8080</param-value>
     </init-param>
    </filter>‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

<filter-class>org.alfresco.repo.web.filter.beans.BeanProxyFilter</filter-class>
     <init-param>
      <param-name>beanName</param-name>
      <param-value>AuthenticationFilter</param-value>
     </init-param>‍‍‍‍‍

<filter-class>com.keembay.alfresco.web.app.servlet.CASAuthenticationFilter</filter-class>
  <init-param>
   <param-name>cas.user.label</param-name>
   <param-value>edu.yale.its.tp.cas.client.filter.user</param-value>
  </init-param>
 </filter>‍‍‍‍‍‍

<filter-mapping>
        <filter-name>CAS Filter</filter-name>
        <url-pattern>/faces/*</url-pattern>
    </filter-mapping>‍‍‍‍

 <filter-mapping>
      <filter-name>Authentication Filter</filter-name>
      <url-pattern>/faces/*</url-pattern>
   </filter-mapping>‍‍‍‍

You also need the casclient-2.1.1.jar, keembay-alfresco-cas.jar and the commons-logging-1.1.jar in the alfresco classpath (($ALFRESCO_HOME$/tomcat/webapps/alfresco/WEB-INF/lib, I have tried to put them in the $ALFRESCO_HOME$/tomcat/lib, but it seems not to work…)

In the tomcat server.xml you need to enabled connector element for port 8443:

<Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
         maxThreads="150" scheme="https" secure="true"
         clientAuth="false" sslProtocol="TLS" 
         keystoreFile="C:/Documents and Settings/user/.keystore"
         keystorePass="changeit" 
         truststoreFile="C:/JDKS/jdk1.6.0_14/jre/lib/security/cacerts" />‍‍‍‍‍‍

Before this you need a certificate and import it on your own keystore. You could do this with the keytool utility:

keytool -genkey -alias tomcat -keypass changeit -keyalg RSA
keytool -export -alias tomcat -keypass changeit -file server.crt
keytool -import -file server.crt -keypass changeit -keystore ..\jre\lib\security\cacerts

If you requested the alfresco client http://hostname:8080/alfresco you should be forwarded to the cas-server/login, be autheticated and forwarded to the user's dashboard of alfresco.

At this point, with the 3.2r I have a problem. If I don't put anything on the alfresco-global.properties alfresco throws the next exception:

org.alfresco.repo.security.authentication.AuthenticationException: 07110003 Failed to set current user administrator. ‍

.
As far I can see the user is authenticated for CAS but it seems that alfresco can not bind the user:

2010-08-11 10:03:02,976 INFO [org.jasig.cas.authentication.AuthenticationManagerImpl] - AuthenticationHandler: org.jasig.cas.adaptors.ldap.FastBindLdapAuthenticationHandler successfully authenticated the user which provided the following credentials: [username: administrator]
2010-08-11 10:03:02,992 INFO [org.jasig.cas.CentralAuthenticationServiceImpl] - Granted service ticket [ST-1-UEJwWo1Ma6PL9C3rgX6X-cas] for service [http://guadalajara:8080/alfresco/faces/jsp/dashboards/container.jsp] for user [administrator] ‍‍

If I enable the external authentication subsystem, this is, in the alfresco-global.properties: authentication.chain=external1:external alfresco says:

org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'localAuthenticationService' defined in file [C:\Portal-FW\plataformaj2ee\entornos\alfresco-community-tomcat-3.2r\tomcat\shared\classes\alfresco\extension\subsystems\Authentication\external\external1\external-authentication-context.xml]: Cannot resolve reference to bean 'sysAdminParams' while setting bean property 'sysAdminParams'; nested exception is org.springframework.beans.factory.NoSuchBeanDefinitionException: No bean named 'sysAdminParams' is defined
caused by:
org.springframework.beans.factory.NoSuchBeanDefinitionException: No bean named 'sysAdminParams' is defined‍‍‍

I have read in the wiki that this subsystem is part of the enterprise edition, so I'm a little bit confused. I have tried to copy from the 3.2r2 distribution, but it doesn't work…

Any idea?

Thanks in advance,

Luis

Re: Alfresco 3.2r2 and CAS with LDAP, SEVER: Error filterStart

ankit_yakkundi — Wed, 18 Aug 2010 12:06:51 GMT

Hi..
Did it worked with 3.2r enterprise edition??? The problem which i am facing now is that when i login with http://localhost:8080/alfresco, it opens the CAS login window. I log into cas with admin/admin, then i am directed to the alfresco web client login page, where i have to login again.

As far as i know SSO does not work like this,once i have logged in through CAS , i should be able to access webclient as well as share. How can i integrate share with SSO. When i login with http://localhost:8080/share , share's login page opens. I haven't done any changes for share. What all changes i need to do , so that share is integrated with SSO.

Even when i logout from alfresco, alfresco's login page opens.

I have reffered the below wiki.
http://www.liferay.com/community/wiki/-/wiki/Main/Integrating+Liferay%2C+Alfresco%2C+SSO+and+LDAP#_36_messageScroll5597539

when i add the the following code in titlebar jsp page in $ALFRESCO_HOME /jsp/parts folder and click on login, error is shown informing

javax.faces.FacesException: /jsp/dashboards/container.jsp(58,0) File "/jsp/dashboards/../parts/titlebar.jsp" not found

.
believe this code helps the user to redirect to CAS page when user logout.

Any ideas or sugestions are welcome..
Thanks in advance..

Ankit