topic Re: Credentials can not be delegated - Alfresco Share in Alfresco Archive

Credentials can not be delegated - Alfresco Share

leftcase — Fri, 15 Jun 2012 15:54:20 GMT

Hi folks,I've hit a brick wall configuring Alfresco 4.0.d on Redhat 6. I'm using Kerberos authentication, it seems to be working normally, and single sign on is working on the main alfresco app itself. I've been through the configuration steps to get the share app working, but try as I may, I keep g

Re: Credentials can not be delegated - Alfresco Share

afaust — Sat, 16 Jun 2012 11:46:22 GMT

Hello,

have you tried running your server with Java GSS debugging turned on (parameter "-Dsun.security.krb5.debug=true -Dsun.security.jgss.debug=true")? This should help you determine if your server is actually authenticating using the correct principal - the one you set up as being able to delegate.

Regards
Axel

Re: Credentials can not be delegated - Alfresco Share

leftcase — Sat, 16 Jun 2012 11:51:38 GMT

I'll give it a go, if there was a problem in the Kerberos setup, wouldn't that stop SSO working via the alfresco app too? Just to confirm, SSO works for /alfresco, just not for /share.

Re: Credentials can not be delegated - Alfresco Share

afaust — Sat, 16 Jun 2012 13:08:10 GMT

Hello,

it would not stop SSO on /alfresco necessarily. /share and /alfresco are technically separate applications which both handle their part in the Kerberos SSO, and a failure in one application (/share) need not occur on the other as well, as the handling is partially different.

Regards
Axel

Re: Credentials can not be delegated - Alfresco Share

leftcase — Sat, 16 Jun 2012 13:15:59 GMT

Thanks for the debugging advice, it was really helpful. It revealed a few errors including:

KrbException: Invalid option setting in ticket request. (101)‍

I'm not any kind of Kerberos expert, but this seemed to point to a problem with the setup of Kerberos on the alfreso server. I revisited /etc/krb5.conf, removed the options for proxying and forwarding, ran kdestroy and restarted alfresco.

Fingers crossed, SSO now seems to be working properly for both the /alfresco and /share apps.

Thank you Axel.

Re: Credentials can not be delegated - Alfresco Share

supriya_verma — Mon, 29 Apr 2019 06:07:24 GMT

Hello ,

I am facing the same error, facing issue to enable kerberos SSO in share.

I have added the debug config "-Dsun.security.krb5.debug=true -Dsun.security.jgss.debug=true" . whereas I am nota ble to see any o/p in catalina.log , alfresco.log or share.log. Could you please let me know the steps to debug kerberos.

Re: Credentials can not be delegated - Alfresco Share

shocko — Thu, 16 May 2019 18:30:03 GMT

Please post your properties files also.

Re: Credentials can not be delegated - Alfresco Share

shocko — Fri, 31 May 2019 20:36:27 GMT

Not necessarily. Kerberos delegation operates differently.