topic Kerberos SSO unsupported SPNEGO in Alfresco Archive https://connect.hyland.com/t5/alfresco-archive/kerberos-sso-unsupported-spnego/m-p/259997#M213127 <HTML><HEAD></HEAD><BODY><SPAN>Hi there</SPAN><BR /><BR /><SPAN>I'm trying to use SSO Kerberos with Alfresco 4.2c on Tomcat 7 (Ubuntu, OpenJDK 7) and Kerberos (Ubuntu, MIT krb5). When I try to access alfresco from my Mac (using Firefox or Google Chrome) I get redirected to username/password login form (which actually works fine).</SPAN><BR /><BR /><SPAN>Debug messages in the alfresco log look as follows:</SPAN><BR /><BR /><PRE class="language-none line-numbers"><CODE>2012-12-17 18:29:43,369&nbsp; DEBUG [app.servlet.KerberosAuthenticationFilter] [http-bio-8080-exec-1] New Kerberos auth request from xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx:49251)<BR /> 2012-12-17 18:29:43,369&nbsp; DEBUG [app.servlet.KerberosAuthenticationFilter] [http-bio-8080-exec-1] Issuing login challenge to browser.<BR /> 2012-12-17 18:29:43,424&nbsp; DEBUG [app.servlet.KerberosAuthenticationFilter] [http-bio-8080-exec-1] Unsupported SPNEGO mechanism 1.3.6.1.4.1.311.2.2.10<BR /> 2012-12-17 18:29:43,424&nbsp; DEBUG [app.servlet.KerberosAuthenticationFilter] [http-bio-8080-exec-1] Clearing session.<BR /> 2012-12-17 18:29:43,424&nbsp; DEBUG [app.servlet.KerberosAuthenticationFilter] [http-bio-8080-exec-1] Issuing login challenge to browser.<BR /> 2012-12-17 18:29:43,525&nbsp; DEBUG [app.servlet.KerberosAuthenticationFilter] [http-bio-8080-exec-4] Login page requested, chaining …<SPAN class="line-numbers-rows"><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN></SPAN></CODE></PRE><BR /><SPAN>alfresco-global.properties looks as follows:</SPAN><BR /><BR /><PRE class="language-none line-numbers"><CODE>authentication.chain=kerberos:kerberos<BR /><BR />#krb5<BR />kerberos.authentication.realm=XXX.XX<BR />kerberos.authentication.sso.enabled=true<BR />kerberos.authentication.authenticateCIFS=true<BR />kerberos.authentication.user.configEntryName=Alfresco<BR />kerberos.authentication.cifs.configEntryName=AlfrescoCIFS<BR />kerberos.authentication.http.configEntryName=AlfrescoHTTP<BR />kerberos.authentication.cifs.password=xxx<BR />kerberos.authentication.http.password=xxx<BR />kerberos.authentication.defaultAdministratorUserNames=xxx<SPAN class="line-numbers-rows"><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN></SPAN></CODE></PRE><BR /><SPAN>alfresco.login.config (included in java.security) looks as follows:</SPAN><BR /><BR /><PRE class="language-none line-numbers"><CODE>Alfresco {<BR />&nbsp;&nbsp; com.sun.security.auth.module.Krb5LoginModule sufficient;<BR />};<BR /><BR />AlfrescoCIFS {<BR />&nbsp;&nbsp; com.sun.security.auth.module.Krb5LoginModule required<BR />&nbsp;&nbsp; storeKey=true<BR />&nbsp;&nbsp; useKeyTab=true<BR />&nbsp;&nbsp; keyTab="/etc/alfresco.keytab"<BR />&nbsp;&nbsp; principal="cifs/xxx.xxx.xx";<BR />};<BR /><BR />AlfrescoHTTP {<BR />&nbsp;&nbsp; com.sun.security.auth.module.Krb5LoginModule required<BR />&nbsp;&nbsp; storeKey=true<BR />&nbsp;&nbsp; useKeyTab=true<BR />&nbsp;&nbsp; keyTab="/etc/alfresco.keytab"<BR />&nbsp;&nbsp; principal="HTTP/xxx.xxx.xx";<BR />};<SPAN class="line-numbers-rows"><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN></SPAN></CODE></PRE><BR /><SPAN>Alfresco Server Kerberos krb5.conf looks as follows:</SPAN><BR /><BR /><PRE class="language-none line-numbers"><CODE>[realms]<BR />&nbsp;&nbsp;&nbsp;XXX.XX = {<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;kdc = kerberos.xxx.xx<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;admin_server = kerberos.xxx.xx<BR />&nbsp;&nbsp;&nbsp;}<BR /><BR />[domain_realm]<BR />&nbsp;&nbsp;&nbsp;.xxx.xx = XXX.XX<BR /><BR />[login]<BR />&nbsp;&nbsp;&nbsp;krb4_convert = true<BR />&nbsp;&nbsp;&nbsp;krb4_get_tickets = false<SPAN class="line-numbers-rows"><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN></SPAN></CODE></PRE><BR /><SPAN>I looked into the sources of alfresco and it seems that SPNEGO mech 1.3.6.1.4.1.311.2.2.</SPAN><STRONG>30</STRONG><SPAN> is supported but not 1.3.6.1.4.1.311.2.2.</SPAN><STRONG>10</STRONG><BR /><BR /><SPAN>Need I further configuration in my Firefox/Chrome/Mac? I (unfortunately) do not know much about kerberos negotiation mechs.</SPAN><BR /><BR /><SPAN>Thanks for any suggestions</SPAN></BODY></HTML> Mon, 17 Dec 2012 18:01:50 GMT svent 2012-12-17T18:01:50Z Kerberos SSO unsupported SPNEGO https://connect.hyland.com/t5/alfresco-archive/kerberos-sso-unsupported-spnego/m-p/259997#M213127 Hi thereI'm trying to use SSO Kerberos with Alfresco 4.2c on Tomcat 7 (Ubuntu, OpenJDK 7) and Kerberos (Ubuntu, MIT krb5). When I try to access alfresco from my Mac (using Firefox or Google Chrome) I get redirected to username/password login form (which actually works fine).Debug messages in the alf Mon, 17 Dec 2012 18:01:50 GMT https://connect.hyland.com/t5/alfresco-archive/kerberos-sso-unsupported-spnego/m-p/259997#M213127 svent 2012-12-17T18:01:50Z Re: Kerberos SSO unsupported SPNEGO https://connect.hyland.com/t5/alfresco-archive/kerberos-sso-unsupported-spnego/m-p/259998#M213128 <HTML><HEAD></HEAD><BODY><SPAN>I know this issue is so old, but I have the exact same problem. Has anyone any idea of what might be? Thanks in advance</SPAN></BODY></HTML> Thu, 21 Jan 2016 12:31:27 GMT https://connect.hyland.com/t5/alfresco-archive/kerberos-sso-unsupported-spnego/m-p/259998#M213128 tcuser 2016-01-21T12:31:27Z