topic Re: Single Sign On using Windows Authentication in Alfresco Archive

Single Sign On using Windows Authentication

luminary_mb — Thu, 27 Aug 2009 10:53:14 GMT

Hi,What is the simplest method to enable single sign on so that when users try to access the Alfresco web client, they are automatically logged in via their Windows login credentials? We would still like to maintain the list of users within Alfresco. What type of configuration is required to do this

Re: Single Sign On using Windows Authentication

luminary_mb — Tue, 01 Sep 2009 15:11:29 GMT

Any suggestions on this anyone? Any help will be much appreciated.

Thanks.

Re: Single Sign On using Windows Authentication

paulweb — Tue, 01 Sep 2009 22:04:31 GMT

I work with 3.2, but look this post http://forums.alfresco.com/en/viewtopic.php?f=9&t=21268 and http://wiki.alfresco.com/wiki/Alfresco_Authentication_Subsystems.
i use chain passthru1asstrhru,ldap1:ldap-ad and kerberos1:kerberos. but must worka and with chain alfrescoNtlm1:alfrescoNtlm:ldap1:ldap-ad
if mozilla open in address

about:config

1. ntlm
network.automatic-ntlm-auth.trusted-uris=http://yourdomain
2.kerberos
network.negotiate-auth.trusted-uris=http://yourdomain

Ie7+
1.ntlm
automatic
2.kerberos read post http://forums.alfresco.com/en/viewtopic.php?f=9&t=21268

Re: Single Sign On using Windows Authentication

luminary_mb — Wed, 09 Sep 2009 16:45:03 GMT

Ive edited the web.xml file to change the settings to use NTLM authentication, and Ive added the domain settings into the file-servers.xml file. Ive decided not to use NTLM Passthrough because I'd like to control the users within Alfresco.

When I try to access the Alfresco web client now, a Window pops up telling me to enter a username and password which then grants me access to the system. It no longer takes me to the Alfresco login page. But a couple of things…

- Its still not using my Windows credentials to authenticate me and grant me access to the system.
- Why is a window popping up telling me to enter my username and password?

I think I may be missing something in the configuration, such as not connecting to our company's domain controller properly. Does anyone have any ideas on how to get this to work?

Thanks.

Re: Single Sign On using Windows Authentication

dward — Wed, 09 Sep 2009 16:59:25 GMT

What browser are you using?

Re: Single Sign On using Windows Authentication

luminary_mb — Thu, 10 Sep 2009 09:11:52 GMT

Internet Explorer 7 at the moment. But I would also like this to work with Internet Explorer 8 and Mozilla Firefox.

Re: Single Sign On using Windows Authentication

dward — Thu, 10 Sep 2009 10:26:50 GMT

Make sure you add the alfresco server to the "Local intranet" security zone. For that zone, select "Custom Level…" and check what the "User Authentication" settings are.

Re: Single Sign On using Windows Authentication

luminary_mb — Thu, 10 Sep 2009 10:55:41 GMT

Thanks, I've got rid of the Window popping up now that used to ask me for my username and password.

How do I now link my Alfresco application to our company domain controller so that it grants access automatically to anyone in our company thats logged onto their Windows computer through our domain? Do I need to enable NTLM Passthrough for this, or can it be done without Passthrough?

Re: Single Sign On using Windows Authentication

dward — Thu, 10 Sep 2009 11:24:35 GMT

Yes you need to use passthru authentication. And if you want all users and their attributes brought over before they log in, you probably need LDAP sync as well. If you were using v3.2 it would be so much easier to explain!

Re: Single Sign On using Windows Authentication

luminary_mb — Thu, 10 Sep 2009 11:39:41 GMT

OK. So I'm in the process now of configuring the ntlm-authentication-context.xml file to use NTLM passthru. I have the following properties to edit in the authentication component bean:

- useLocalServer
- servers
- personService
- nodeService
- transactionService
- guestAccess

From my understanding, to get this to work I only need to edit the servers property tag to include the IP address of the server where our domain controller is located? What about the domain name itself, where does that go in here? I've already put the domain name into the DomainMappings tag in the file-servers.xml file.

Also what about the other properties in here, do I need to edit them? And finally do I need to add in the protocolOrder property and set it to either NetBIOS or TCPIP?

Re: Single Sign On using Windows Authentication

luminary_mb — Thu, 10 Sep 2009 14:00:34 GMT

Any help much appreciated.

Re: Single Sign On using Windows Authentication

dward — Thu, 10 Sep 2009 14:48:32 GMT

No need to use IP addresses.

set useLocalServer=false

servers=NAMEOFDOMAIN\nameofserver,nameofserver

If you are doing this in a .properties file, the backslash has to be escaped with another backslash. If you are doing it in the XML file directly, it won't.

You should include your server with and without a domain prefix so that JLAN knows where to send it to when the client doesn't send a domain (weird I know).

Re: Single Sign On using Windows Authentication

luminary_mb — Thu, 10 Sep 2009 15:08:52 GMT

Just tried that but its not working. When I try to access the web client it pops up a Window asking for my credentials, and when I enter my Windows username and password or the username and password of a previously created user in Alfresco, it doesnt accept the credentials and just prompts me for them again.

When you say nameofsever you mean the name of the server where our Active Directory is located right? I have looked in the log files and it says the following…

15:58:01,228 Userystem ERROR [smb.protocol.auth] No valid CIFS authentication combination available
15:58:01,228 Userystem ERROR [smb.protocol.auth] Either enable Kerberos support or use an authentication component that supports MD4 hashed passwords
15:58:01,230 Userystem ERROR [alfresco.smb.protocol] CIFS server configuration error, Invalid CIFS authenticator configuration
16:00:10,662 ERROR [app.servlet.NTLMAuthenticationFilter] Client EU01956 using NTLMv2 logon, not valid with passthru authentication

Also do I need to set anything in the other properties (personService, nodeService, transactionService, guestAccess, protocolOrder) in the ntlm-authentication-context.xml file?

Re: Single Sign On using Windows Authentication

dward — Thu, 10 Sep 2009 15:22:48 GMT

The CIFS server isn't happy. You will have to configure the enterprise CIFS authenticator (see file-servers.xml). But that doesn't explain why you can't log in.

The reason why you can't log in is because you must be using a post-XP Windows installation that has NTLM v1 support switched off by default.

To use passthru, you need to enable NTLM v1 on the client machines. Otherwise it might be best to use Kerberos SSO. See

http://wiki.alfresco.com/wiki/Configuring_the_CIFS_and_web_servers_for_Kerberos/AD_integration

Re: Single Sign On using Windows Authentication

luminary_mb — Thu, 10 Sep 2009 15:34:57 GMT

OK I've fixed the CIFS error I was getting by configuring the file-servers.xml file, and it doesnt show those errors in the log file anymore.

But how do I enable NTLM v1 on the client machines?

Re: Single Sign On using Windows Authentication

dward — Thu, 10 Sep 2009 15:39:24 GMT

Is your Google broken or something?

Re: Single Sign On using Windows Authentication

dward — Thu, 10 Sep 2009 15:43:23 GMT

Try http://www.technologyquestions.com/technology/windows-vista/50823-force-ntlm-vista-home-premium.html

Re: Single Sign On using Windows Authentication

luminary_mb — Thu, 10 Sep 2009 16:01:03 GMT

I tried Googling for it but couldnt find much on enabling NTLM v1, everything seemed to point me towards enabling NTLM v2.

But anyway I tried your link, changed the settings on my computer to use NTLM v1 and it works perfect!!! I also got another two users to enable NTLM v1 and access the Alfresco web client and it worked for them too!

Thanks a lot!

Re: Single Sign On using Windows Authentication

dward — Thu, 10 Sep 2009 18:04:35 GMT

Maybe my Google is better than yours!

Re: Single Sign On using Windows Authentication

luminary_mb — Fri, 11 Sep 2009 09:26:37 GMT

Just a question, in the article http://wiki.alfresco.com/wiki/3.0_Configuring_NTLM, it says:

Note that since Alfresco 3.0 NTLMv2 is now supported which is more secure that the NTLMv1 previously supported - and NTLMv2 will automatically downgrade to NTLMv1 if the client does not support it.

So if our client machines do not support NTLMv2 and only support NTLMv1, then why doesnt the Alfresco server automatically downgrade to NTLMv1 if thats what it says in the article?