topic Re: CIFS and Kerberos authentication errors in Alfresco Archive

CIFS and Kerberos authentication errors

cmgray — Fri, 29 Jan 2010 21:58:57 GMT

I've searched for answers to this problem and have yet to see anyone that is experiencing what I am right now.I have community 3.2r2 setup to use kerberos authentication for CIFS. I have the configuration all set from what I can tell, after some back and forth we finally got the CIFS principal and

Re: CIFS and Kerberos authentication errors

rosemeyer2 — Mon, 01 Feb 2010 08:19:14 GMT

Please post the configuration changes you have done to the default settings, so it's easier to find a solution. Also, did you enable logging for CIFS?

Re: CIFS and Kerberos authentication errors

cmgray — Mon, 01 Feb 2010 19:54:10 GMT

Here is the configuration. Thanks for any insight you can offer. I've turned on as much logging as I can, I even resorted at one point to setting the entire log to debug to try to figure it out but it added no additional info. So I went to the step of manually adding more debug statements to the EnterpriseCifsAuthenticator.java class and compiling it into my installation so I could trace what was happening.

Configuration:

kerberos.authentication.realm=REALM.NAU.EDU
kerberos.authentication.user.configEntryName=Alfresco
kerberos.authentication.defaultAdministratorUserNames=
kerberos.authentication.cifs.configEntryName=AlfrescoCIFS
kerberos.authentication.cifs.password=nothing
kerberos.authentication.authenticateCIFS=true‍‍‍‍‍‍

Alfresco {
    com.sun.security.auth.module.Krb5LoginModule sufficient;
};

AlfrescoCIFS {
    com.sun.security.auth.module.Krb5LoginModule required
    debug=true
    storeKey=true
    useKeyTab=true
    keyTab="/opt/alfresco/krb/srv_AlfrescoCIFS_DEV.KEYTAB"
    principal="CIFS/server.nau.edu";
};

AlfrescoHTTP {
   com.sun.security.auth.module.Krb5LoginModule required
   storeKey=true
   useKeyTab=true
   keyTab="/opt/alfresco/krb/srv_AlfrescoHTTP_DEV.KEYTAB"
   principal="HTTP/server.nau.edu";
};

com.sun.net.ssl.client {
    com.sun.security.auth.module.Krb5LoginModule sufficient;
};

other {
    com.sun.security.auth.module.Krb5LoginModule sufficient;
};‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍


[logging]
    default = FILE:/var/log/krb5libs.log
    kdc = FILE:/var/log/krb5kdc.log
    admin_server = FILE:/var/log/kadmind.log

[libdefaults]
    default_realm = REALM.NAU.EDU
    default_tkt_enctypes = DES-CBC-MD5
    default_tgs_enctypes = DES-CBC-MD5

[realms]
    NAU.FROOT.NAU.EDU = {
        kdc = server.nau.edu
        admin_server = server.nau.edu
    }

[domain_realm]
    server.nau.edu = REALM.NAU.EDU
    .server.nau.edu = REALM.NAU.EDU ‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Re: CIFS and Kerberos authentication errors

dward — Tue, 02 Feb 2010 10:21:33 GMT

It looks like your client is trying to negotiate NTLM authentication, despite your server not offering it.

Do these help?

http://support.microsoft.com/kb/299838

http://groups.google.co.uk/group/microsoft.public.platformsdk.security/browse_thread/thread/8ce32f7a9a7f165b/8ef112f8f058cd7c?hl=en&ie=UTF-8&q=Why+Negotiate+choose+NTLM+instead+of+Kerberos&pli=1

Re: CIFS and Kerberos authentication errors

cmgray — Wed, 03 Feb 2010 20:29:53 GMT

Actually, yes that did help, it led me to try some other clients to see if the behavior differed.

So it turns out that from other machines such as Windows XP, or Mac OS X it works fine. But windows 7 seems to have an issue.

I get this error message: "A specified logon session does not exist. It may already have been terminated"

So I'm not sure exactly what is causing this problem now.

-Chris

Re: CIFS and Kerberos authentication errors

cmgray — Wed, 03 Feb 2010 22:55:41 GMT

Actually, I take that back. On a mac OS X when I try to connect I get an access denied error. In the log is the same error: Exception doing hashed password logon: Attempt to use non SSO-enabled authentication component for SSO

It appears the the Mac is trying NTLM instead of kerberos. Is it even possible to do this with a mixed environment?