topic Re: SSO broken with 3.3 Upgrade in Alfresco Archive

SSO broken with 3.3 Upgrade

maxim — Thu, 15 Apr 2010 13:07:09 GMT

Have a funny thing happening…. Upgraded from 3.2 to 3.3 and found that SSO no longer works. The passthru authentication is still happy and I can authenticate against AD but only with the login screen. Has anyone else experienced this? The log snip below shows the last line of initialisation loggin

Re: SSO broken with 3.3 Upgrade

juan — Thu, 15 Apr 2010 14:10:09 GMT

The happened to me, so I opened an issue:

https://issues.alfresco.com/jira/browse/ALF-2420

Re: SSO broken with 3.3 Upgrade

piski — Fri, 23 Apr 2010 10:03:04 GMT

I have the same issue like you on my fresh Alfresco 3.3 installation

Moreover, It's impossible to apply patch which was available for Alfresco 3.2r2 ( https://issues.alfresco.com/jira/browse/ALFCOM-3801) because of the architecture seemed to change.

I hope there will be a fix available very soon !!!

Re: SSO broken with 3.3 Upgrade

p3d3r0s0 — Mon, 26 Apr 2010 16:53:00 GMT

Is this confirmed? Is it impossible to use SSO on version 3.3?

Re: SSO broken with 3.3 Upgrade

piski — Tue, 27 Apr 2010 08:04:32 GMT

Yeah I confirm it … For me when I try to access to share (DM works normally) by SSO (passthru), it fails without error message but the form login appears.

Moreover, sometimes I can't access to share because my login / password don't work !
I close my web browser, I login again and then this time, this works (I can reproduce the problem).

Re: SSO broken with 3.3 Upgrade

loftux — Tue, 27 Apr 2010 08:13:00 GMT

Hi,

Maybe because of this? https://issues.alfresco.com/jira/browse/ALF-2605 (webscript-framework-config-custom.xml no longer read)
I was trying to get the external Authentication to work (http://forums.alfresco.com/en/viewtopic.php?f=9&t=26472), and didn't get it to work. For me it looks like your issue may be that the webscript-framework-config-custom.xml is no longer taken into account.

Re: SSO broken with 3.3 Upgrade

loftux — Tue, 27 Apr 2010 11:17:47 GMT

Hi,

Can you try to put what you have in webscript-framework-config-custom.xml in share-config-custom.xml instead and see if it works?
Make sure you have only one in you classpath, as it seems like only one of them is loaded.

Re: SSO broken with 3.3 Upgrade

piski — Wed, 28 Apr 2010 09:10:17 GMT

I confirm the problem : if you place the content of webscript-framework-config-custom.xml in share-config-custom.xml, SSO with Share works fine.

So, your problem analysis was good, the file webscript-framework-config-custom.xml seems to be ignored (overriden ?).

Waiting a definitive fix, The file share-config-custom.xml should looks like :

<alfresco-config>

   <!– Global config section –>
   <config replace="true">
      <flags>
         <!–
            Developer debugging setting to turn on DEBUG mode for client scripts in the browser
         –>
         <client-debug>true</client-debug>

         <!–
            LOGGING can always be toggled at runtime when in DEBUG mode (Ctrl, Ctrl, Shift, Shift).
            This flag automatically activates logging on page load.
         –>
         <client-debug-autologging>false</client-debug-autologging>
      </flags>
   </config>

   <!– Document Library config section –>
   <config evaluator="string-compare" condition="DocumentLibrary" replace="true">

      <!–
         Whether the folder Tree component should enumerate child folders or not.
         This is a relatively expensive operation, so should be set to "false" for Repositories with broad folder structures.
      –>
      <tree>
         <evaluate-child-folders>false</evaluate-child-folders>
      </tree>

      <!–
         Used by the "Manage Aspects" action

         For custom aspects, remember to also add the relevant i18n string(s)
            cm_myaspect=My Aspect
      –>
      <aspects>
         <!– Aspects that a user can see –>
         <visible>
            <aspect name="cm:generalclassifiable" />
            <aspect name="cm:complianceable" />
            <aspect name="cm:dublincore" />
            <aspect name="cm:effectivity" />
            <aspect name="cm:summarizable" />
            <aspect name="cm:versionable" />
            <aspect name="cm:templatable" />
            <aspect name="cm:emailed" />
            <aspect name="emailserver:aliasable" />
            <aspect name="cm:taggable" />
            <aspect name="app:inlineeditable" />
         </visible>

         <!– Aspects that a user can add. Same as "visible" if left empty –>
         <addable>
         </addable>

         <!– Aspects that a user can remove. Same as "visible" if left empty –>
         <removeable>
         </removeable>
      </aspects>

      <!–
         Used by the "Change Type" action

         Define valid subtypes using the following example:
            <type name="cm:content">
               <subtype name="cm:mysubtype" />
            </type>

         Remember to also add the relevant i18n string(s):
            cm_mysubtype=My SubType
      –>
      <types>
         <type name="cm:content">
            <subtype name="cm:mycontentsubtype" />
         </type>

         <type name="cm:folder">
            <subtype name="cm:myfoldersubtype" />
         </type>
      </types>

      <!–
         If set, will present a WebDAV link for the current item on the Document and Folder details pages.
         Also used to generate the "View in Alfresco Explorer" action for folders.
      –>
      <repository-url>http://localhost:8080/alfresco</repository-url>
   </config>

   <!– Repository Library config section –>
   <config evaluator="string-compare" condition="RepositoryLibrary" replace="true">
      <!–
         Whether the link to the Repository Library appears in the header component or not.
      –>
      <visible>true</visible>

      <!–
         Root nodeRef for top-level folder.
      –>
      <root-node>alfresco://company/home</root-node>

      <!–
         Whether the folder Tree component should enumerate child folders or not.
         This is a relatively expensive operation, so should be set to "false" for Repositories with broad folder structures.
      –>
      <tree>
         <evaluate-child-folders>false</evaluate-child-folders>
      </tree>
   </config>

   <!– IMPORTANT - USED TO SOLVE SSO SHARE BUG –>
   <!– Overriding endpoints to reference an Alfresco server with external SSO or NTLM enabled –>
   <!– NOTE: For NTLM, the NTLM Authentication Filter must also be enabled in share web.xml –>
   <!– NOTE: if utilising a load balancer between web-tier and repository cluster, the "sticky –>
   <!–       sessions" feature of your load balancer must be used –>
   <!– Optional keystore contains SSL client certificate + trusted CAs. Used to authenticate share to an external SSO system such as CAS –>
   <config evaluator="string-compare" condition="Remote">
        <remote>
            <keystore>
                <path>alfresco/web-extension/alfresco-system.p12</path>
                <type>pkcs12</type>
                <password>alfresco-system</password>
            </keystore>
         
            <endpoint>
                <id>alfresco</id>
                <name>Alfresco - user access</name>
                <description>Access to Alfresco Repository WebScripts that require user authentication</description>
                <connector-id>alfresco</connector-id>
                <endpoint-url>http://localhost:8080/alfresco/wcs</endpoint-url>
                <identity>user</identity>
                <external-auth>true</external-auth>
                <authenticator-id>alfresco-ticket</authenticator-id>
            </endpoint>
            
        </remote>
    </config>
   <!– IMPORTANT - USED TO SOLVE SSO SHARE BUG –>

</alfresco-config>‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Re: SSO broken with 3.3 Upgrade

p3d3r0s0 — Wed, 28 Apr 2010 10:51:10 GMT

Other then the changes in the above post, is there a tutorial on how to get AD working with Alfresco? The documentation i have seems to be out of date(references to non existing fields or files).

Best regards

Re: SSO broken with 3.3 Upgrade

maxim — Wed, 28 Apr 2010 11:32:39 GMT

I tried moving the NTLM autentication content from webscript-framework-config-custom.xml to share-config-custom.xml in the shared\classes\alfresco\web-extension directory. Unfortunately I get the same error… interested to know if piski did anything different?

Thanks

Max

Re: SSO broken with 3.3 Upgrade

piski — Wed, 28 Apr 2010 13:08:09 GMT

P3d3r0s0 : (I'm not a moderator !!!) but I think you have to create another post because this is the best way to keep a topic clear (only focused on 1 subject) …

Maxim : Simple question -> have you restart your Alfresco Server ? To answer your question, I did only the thing I describe in my previous post, as suggested by Loftux.

Re: SSO broken with 3.3 Upgrade

p3d3r0s0 — Wed, 28 Apr 2010 13:46:10 GMT

I think its related, i need to make SSO work on Alfresco, and i was wondering if there was a step by step tutorial somewhere to make this happen. Including installing AD, which i believe you would need to make SSO work(im very new to this).

Re: SSO broken with 3.3 Upgrade

loftux — Wed, 28 Apr 2010 14:20:10 GMT

@Maxim: Check that you don't have 2 share-config-custom.xml in you classpath, if you have installed some addon you may find one in tomcat/webapps/share/WEB-INF/classes/alfresco/web-extension. It looks like tomcat/alfresco only can pick up one of them.
If you find 2, try to merge them so that you only have one.

Re: SSO broken with 3.3 Upgrade

maxim — Wed, 28 Apr 2010 23:48:04 GMT

Fixed by following Loftux & piski suggestions…. the problem I had was that I copy and pasted from piski's share-config-custom.xml exrtact in this thread…. Alfresco doesn't like the '—-' in the comments and wouldn't read the file.

Should teach me to read the log file first! ops:

Thanks

Max

Re: SSO broken with 3.3 Upgrade

piski — Wed, 12 May 2010 15:24:11 GMT

SSO is now fixed !
https://issues.alfresco.com/jira/browse/ALF-2420

and the wiki is up to date : http://wiki.alfresco.com/wiki/Alfresco_Authentication_Subsystems#Alfresco_Share_SSO_using_NTLM

Thanks !

Re: SSO broken with 3.3 Upgrade

pat2man — Wed, 12 May 2010 18:02:12 GMT

So NTLM is working, what about external authentication? Seems the <keystore> bit is still not there…

Re: SSO broken with 3.3 Upgrade

kevinr — Thu, 08 Jul 2010 09:42:27 GMT

That config has now been added back into the .sample file in the trunk, here is the snippet:


   <!– 
        Overriding endpoints to reference an Alfresco server with external SSO enabled
        NOTE: If utilising a load balancer between web-tier and repository cluster, the "sticky
              sessions" feature of your load balancer must be used.
        NOTE: If alfresco server location is not localhost:8080 then also combine changes from the
              "example port config" section below.
        *Optional* keystore contains SSL client certificate + trusted CAs.
        Used to authenticate share to an external SSO system such as CAS
        Remove the keystore section if not required i.e. for NTLM.
   –>
   <!–
   <config evaluator="string-compare" condition="Remote">
      <remote>
         <keystore>
             <path>alfresco/web-extension/alfresco-system.p12</path>
             <type>pkcs12</type>
             <password>alfresco-system</password>
         </keystore>
         
         <connector>
            <id>alfrescoCookie</id>
            <name>Alfresco Connector</name>
            <description>Connects to an Alfresco instance using cookie-based authentication</description>
            <class>org.springframework.extensions.webscripts.connector.AlfrescoConnector</class>
         </connector>
         
         <endpoint>
            <id>alfresco</id>
            <name>Alfresco - user access</name>
            <description>Access to Alfresco Repository WebScripts that require user authentication</description>
            <connector-id>alfrescoCookie</connector-id>
            <endpoint-url>http://localhost:8080/alfresco/wcs</endpoint-url>
            <identity>user</identity>
            <external-auth>true</external-auth>
         </endpoint>
      </remote>
   </config>
   –>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍