topic Re: Bug Kerberos or Bug congiguration? in Alfresco Archive

Bug Kerberos or Bug congiguration?

paulweb — Tue, 01 Sep 2009 01:15:24 GMT

os:centos52alfresco last versionauthentication with kerberos(automatic)we have lead the following testi have account in MY-DOMAIN.RU and have account in NKH.MY-DOMAIN.RU (p.web@MY-DOMAIN.RU and p.web@NKH.MY-DOMAIN.RU).when i try to enter in alfresco in MY-DOMAIN.RU: alfresco create user p.web and f

Re: Bug Kerberos or Bug congiguration?

paulweb — Tue, 01 Sep 2009 06:38:58 GMT

I have rewritten BaseKerberosAuthenticationFilter.java and all earn normall, but
i have understated because you cut userNames in browser following anchor file://…/p.web@my-domain.ru not open, but in windows explorer open normall
look this code in BaseKerberosAuthenticationFilter.java line 547


SessionUser user = createUserEnvironment( httpSess, krbDetails.getUserName());
‍‍‍

KrbDetails.java


 public final String getUserName() {

    String userName = m_krbSource;

    if (m_krbSource != null) {
      int pos = m_krbSource.indexOf('@');
      if (pos != -1) {
        userName = m_krbSource.substring(0, pos);
      }
    }

    return userName;
  } 
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

and alfresco create user p.web
if change in BaseKerberosAuthenticationFilter.java


SessionUser user = createUserEnvironment( httpSess, krbDetails.getSourceName());
‍‍‍

alfresco create user and folder p.web@my-domain.ru
Also there are no collisions with the affiliated domain because when i enter in alfresco in NKH.MY-DOMAIN.RU alfresco create user and folder p.web@NKH.MY-DOMAIN.RU

😎

Re: Bug Kerberos or Bug congiguration?

paulweb — Wed, 02 Sep 2009 00:37:13 GMT

One more solution: for each domain to create a root folder of type "User homes" for users.
The way how to correct it and without the aid of corrections in a program code can and is.

https://issues.alfresco.com/jira/browse/ALFCOM-3363

Re: Bug Kerberos or Bug congiguration?

paulweb — Wed, 02 Sep 2009 05:55:20 GMT

How to?
in web-client-config.xml we have following
<default-home-space-path>/app:company_home/app:user_homes</default-home-space-path>
How to lead to its following format?
<default-home-space-path>/{MY-DOMAIN.RU}/app:user_homes</default-home-space-path>
and maybe if affiliate domain for example NKH.MY-DOMAIN.RU
<default-home-space-path>/{MY-DOMAIN.RU}/{NKH}/app:user_homes</default-home-space-path>

Re: Bug Kerberos or Bug congiguration?

paulweb — Fri, 04 Sep 2009 00:57:30 GMT

https://issues.alfresco.com/jira/browse/ALFCOM-3363

David Ward added a comment - 03-Sep-09 07:33 PM
It looks like there has been inconsistent use made of KerberosDetails.getSourceName() (includes the @ symbol) and KerberosDetails.getUserName().
Note we don't support multiple Kerberos domains at the same time, but we should at least resolve the username consistently on CIFS and Web log in.

And not only with kerberos! Or at the organisation of other chain of authentification all will work?
I will realise all the same support multiple domains.
The circuit as should be:
We have following the organisation of domains with users
FOREST
MY-DOMAIN.RU
         p.web
         a.shum
NKH.MY-DOMAIN.RU
         a.shum
         k.nett
Authentification: automaitic with the help kerberos and with synchronisation with AD with filtering of users (for example if auditors for check access to Alfresco is not necessary to them have come)

Users should be with a complete name that is
p.web@my-domain.ru
a.shum@nkh.my-domain.ru
Or here still the variant can be saved and in the truncated variant but it is necessary then to add hash (name+pass), for sharing of users with an identical name, but different passwords

In ALFRESCO there will be a following structure of folders (or at the first visiting of the user or is possible at instructions of customisations)
ROOTFOLDER (COMPANY NAME)
    MY-DOMAIN.RU
            p.web
            a.shum
    NKH.MY-DOMAIN.RU
            a.shum
            k.nett
That is at an enter user in ALFRESCO, on its suffix its personal folder will be defined where to be

Here such circuit

If who has a sentence on supports multiple domains in ALFRESCO write and if there is an implementation, share with community

Re: Bug Kerberos or Bug congiguration?

paulweb — Wed, 09 Sep 2009 10:18:01 GMT

I have made it (now we test)

Re: Bug Kerberos or Bug congiguration?

paulweb — Fri, 11 Sep 2009 08:44:02 GMT

alfresco support multiple Kerberos domains with my patch 😎

Re: Bug Kerberos or Bug congiguration?

lutz_horn — Thu, 01 Oct 2015 14:40:46 GMT

Hi Paul, can you please share your patch? What did you change to allow login with subdomains?