topic Kerberos authentication in Alfresco Archive https://connect.hyland.com/t5/alfresco-archive/kerberos-authentication/m-p/246854#M199984 <HTML><HEAD></HEAD><BODY><SPAN>I can logon with alfresco explorer but not alfresco share. When I try and logon to alfresco share, it actually brings up a windows popup box. If I use an AD account it won't let me on but the builtin alfresco admin would work. I can't see any errors in catalina.out and if I run kinit on the alfresco server, it is using authenticating correctly using kerberos.</SPAN><BR /><BR /><SPAN>My java.login.config file</SPAN><BR /><PRE class="language-none line-numbers"><CODE>Alfresco {<BR />&nbsp;&nbsp; com.sun.security.auth.module.Krb5LoginModule sufficient;<BR />};<BR /><BR />svc-alfrescocifs {<BR />&nbsp;&nbsp; com.sun.security.auth.module.Krb5LoginModule required<BR />&nbsp;&nbsp; storeKey=true<BR />&nbsp;&nbsp; useKeyTab=true<BR />&nbsp;&nbsp; keyTab="/etc/svc-alfrescocifs.keytab"<BR />&nbsp;&nbsp; principal="cifs/srv11-0015.inst.camlab";<BR />};<BR /><BR />svc-alfrescohttp {<BR />&nbsp;&nbsp; com.sun.security.auth.module.Krb5LoginModule required<BR />&nbsp;&nbsp; storeKey=true<BR />&nbsp;&nbsp; useKeyTab=true<BR />&nbsp;&nbsp; keyTab="/etc/svc-alfrescohttp.keytab"<BR />&nbsp;&nbsp; principal="HTTP/srv11-0015.inst.camlab";<BR />};<BR /><BR />com.sun.net.ssl.client {<BR />&nbsp;&nbsp; com.sun.security.auth.module.Krb5LoginModule sufficient;<BR />};<BR /><BR />other {<BR />&nbsp;&nbsp; com.sun.security.auth.module.Krb5LoginModule sufficient;<BR />};<BR /><BR /><BR />ShareHTTP {<BR />&nbsp;&nbsp; com.sun.security.auth.module.Krb5LoginModule required<BR />&nbsp;&nbsp; storeKey=true<BR />&nbsp;&nbsp; useKeyTab=true<BR />&nbsp;&nbsp; keyTab="/etc/svc-alfrescohttp.keytab"<BR />&nbsp;&nbsp; principal="HTTP/srv11-0015.inst.camlab";<BR /><SPAN class="line-numbers-rows"><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN></SPAN></CODE></PRE><BR /><SPAN>and krb5.conf</SPAN><BR /><PRE class="language-none line-numbers"><CODE>[logging]<BR /> default = FILE:/var/log/krb5libs.log<BR /> kdc = FILE:/var/log/krb5kdc.log<BR /> admin_server = FILE:/var/log/kadmind.log<BR /><BR />[libdefaults]<BR /> default_realm = INST.CAMLAB<BR /> default_tkt_enctypes = rc4-hmac<BR /> default_tgs_enctypes = rc4-hmac <BR /><BR /> dns_lookup_realm = false<BR /> dns_lookup_kdc = false<BR /> ticket_lifetime = 24h<BR /> forwardable = yes<BR /><BR />[realms]<BR /> INST.CAMLAB = {<BR />&nbsp; kdc = instlab01.inst.camlab:88<BR />&nbsp; admin_server = instlab01.inst.camlab:749<BR />&nbsp; default_domain = inst.camlab<BR /> }<BR /><BR />[domain_realm]<BR />instlab01.inst.camlab = INST.CAMLAB<BR />.instlab01.inst.camlab = INST.CAMLAB<BR /><SPAN class="line-numbers-rows"><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN></SPAN></CODE></PRE><BR /><SPAN>share-config-custom.xml</SPAN><BR /><PRE class="language-none line-numbers"><CODE> &lt;!– Kerberos settings –&gt;<BR />&nbsp;&nbsp; &lt;!– To enaable kerberos rename this condition to "Kerberos" –&gt;<BR />&nbsp;&nbsp; &lt;config evaluator="string-compare" condition="Kerberos" replace="true"&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;kerberos&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;!–<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Password for HTTP service account.<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; The account name *must* be built from the HTTP server name, in the format :<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; HTTP/&lt;server_name&gt;@&lt;realm&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; (NB this is because the web browser requests an ST for the<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; HTTP/&lt;server_name&gt; principal in the current realm, so if we're to decode<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; that ST, it has to match.)<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; –&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;password&gt;xxxxx&lt;/password&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;!–<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Kerberos realm and KDC address.<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; –&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;realm&gt;INST.CAMLAB&lt;/realm&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;!–<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Service Principal Name to use on the repository tier.<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; This must be like: HTTP/host.name@REALM<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; –&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;endpoint-spn&gt;HTTP/SRV11-0015@INST.CAMLAB&lt;/endpoint-spn&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;!–<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; JAAS login configuration entry name.<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; –&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;config-entry&gt;ShareHTTP&lt;/config-entry&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;/kerberos&gt;<BR />&nbsp;&nbsp; &lt;/config&gt;<BR /><BR /><SPAN class="line-numbers-rows"><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN></SPAN></CODE></PRE><BR /><SPAN>and my alfresco-global.properties</SPAN><BR /><PRE class="language-none line-numbers"><CODE>authentication.chain=alfrescoNtlm1:alfrescoNtlm,kerberos1:kerberos<BR />ntlm.authentication.sso.enabled=true<BR />alfresco.authentication.authenticateCIFS=true<SPAN class="line-numbers-rows"><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN></SPAN></CODE></PRE></BODY></HTML> Fri, 30 Dec 2011 09:56:42 GMT luishuang 2011-12-30T09:56:42Z Kerberos authentication https://connect.hyland.com/t5/alfresco-archive/kerberos-authentication/m-p/246854#M199984 I can logon with alfresco explorer but not alfresco share. When I try and logon to alfresco share, it actually brings up a windows popup box. If I use an AD account it won't let me on but the builtin alfresco admin would work. I can't see any errors in catalina.out and if I run kinit on the alfresco Fri, 30 Dec 2011 09:56:42 GMT https://connect.hyland.com/t5/alfresco-archive/kerberos-authentication/m-p/246854#M199984 luishuang 2011-12-30T09:56:42Z Re: Kerberos authentication https://connect.hyland.com/t5/alfresco-archive/kerberos-authentication/m-p/246855#M199985 <HTML><HEAD></HEAD><BODY><SPAN>ntlm.authentication.sso.enabled should not be set to true when using kerberos. Instead you should set kerberos.authentication.sso.enabled to true.</SPAN></BODY></HTML> Tue, 03 Jan 2012 10:51:14 GMT https://connect.hyland.com/t5/alfresco-archive/kerberos-authentication/m-p/246855#M199985 gronfelt 2012-01-03T10:51:14Z