topic Config Kerberos SSO, step by step in Alfresco Archive https://connect.hyland.com/t5/alfresco-archive/config-kerberos-sso-step-by-step/m-p/281020#M234150 <HTML><HEAD></HEAD><BODY><P>i have</P><P>ms ldap - win2008r2 - mydomen.local</P><P>dc01.mydomen.local - controller domen</P><P>client&nbsp; - win7</P><P>alfresco server - fs02.mydomen.local</P><P></P><P></P><P>a need&nbsp; step by step config kerberos!</P><P></P><P>my step:</P><P><STRONG>1.</STRONG> install alfresco-community-installer-201605-linux-x64.bin</P><P>in directory&nbsp; /opt/alfresco-community</P><P>(centos 7 - domen member)</P><P></P><P><STRONG>2.</STRONG> creat two users on domen controller</P><P>&nbsp;&nbsp;&nbsp;&nbsp; name: AlfrescoHTTP(alfrescohttp@mydomen.local)</P><P>&nbsp;&nbsp;&nbsp;&nbsp; password: 12345678</P><P>and</P><P>name: AlfrescoCIFS(alfrescocifs@mydomen.local)</P><P>password: 12345678</P><P></P><P><STRONG>3.</STRONG> on controller domen execute command</P><BLOCKQUOTE><TABLE border="1"><TBODY><TR><TD><P>setspn -a cifs/fs02 alfrescocifs</P><P>setspn -a cifs/fs02.mydomen.local alfrescocifs</P><P>setspn -a HTTP/fs02 alfrescohttp</P><P>setspn -a HTTP/fs02.mydomen.local alfrescohttp</P></TD></TR></TBODY></TABLE></BLOCKQUOTE><P></P><P><STRONG>4.</STRONG> in Account tab set "enable" the <EM>Do not require Kerberos preauthentication</EM> option in the Account Options section</P><P>for users AlfrescoHTTP und AlfrescoCIFS</P><P></P><P><STRONG>5.</STRONG> for user AlfrescoHTTP in D<EM>elegation </EM>tab clicking the radio button <EM>Trust this user for delegation to any service (kerberos only)</EM>.</P><P></P><P><STRONG>6.</STRONG> Make keytab files for AlfrescoCIFS</P><BLOCKQUOTE><TABLE border="1"><TBODY><TR><TD><P>ktpass -princ cifs/fs02.mydomen.local@MYDOMEN.LOCAL -pass 12345678 -mapuser mydomen\alfrescocifs -crypto <STRONG>ALL</STRONG> -ptype KRB5_NT_PRINCIPAL -out c:\temp\alfrescocifs.keytab -kvno 0</P></TD></TR></TBODY></TABLE></BLOCKQUOTE><P>and for user AlfrescoHTTP</P><BLOCKQUOTE><TABLE border="1"><TBODY><TR><TD><P>ktpass -princ HTTP/fs02.mydomen.local@MYDOMEN.LOCAL -pass 12345678 -mapuser mydomen\alfrescohttp -crypto <STRONG>ALL</STRONG> -ptype KRB5_NT_PRINCIPAL -out c:\temp\alfrescohttp.keytab -kvno 0</P></TD></TR></TBODY></TABLE></BLOCKQUOTE><P></P><P><STRONG>7.</STRONG> Copy files c:\temp\alfrescohttp.keytab and c:\temp\alfrescocifs.keytab to alfresco server =&gt; ( fs02)&nbsp;&nbsp;&nbsp; /ets/keys/alfrescohttp.keytab and ets/keys/alfrescocifs.keytab</P><P></P><P><STRONG>8.</STRONG> Edit file ets/krb5.conf</P><BLOCKQUOTE><TABLE border="1"><TBODY><TR><TD><P>[logging]</P><P>default = FILE:/usr/local/samba/var/log/krb5libs.log</P><P>kdc = FILE:/usr/local/samba/var/log/krb5kdc.log</P><P>admin_server = FILE:/usr/local/samba/var/log/kadmind.log</P><P></P><P>[libdefaults]</P><P> default_realm = MYDOMEN.LOCAL</P><P></P><P></P><P>[realms]</P><P>MYDOMEN.LOCAL = {</P><P>&nbsp;&nbsp; default_domain = MYDOMEN.LOCAL</P><P>&nbsp; kdc = dc01.mydomen.local</P><P>&nbsp; admin_server = dc01.mydomen.local</P><P>}</P><P></P><P>[domain_realm]</P><P>mydomen.local = MYDOMEN.LOCAL</P><P>.mydomen.local = MYDOMEN.LOCAL</P><P></P><P>dc01.mydomen.local = MYDOMEN.LOCAL</P><P>.dc01.mydomen.local = MYDOMEN.LOCAL</P></TD></TR></TBODY></TABLE></BLOCKQUOTE><P>(dc01.mydomen.local - controller domen)</P><P></P><P><STRONG>9.</STRONG> create file /opt/alfresco-community/java/lib/security/java.login.config</P><BLOCKQUOTE><TABLE border="1"><TBODY><TR><TD><P>Alfresco {</P><P>&nbsp;&nbsp; com.sun.security.auth.module.Krb5LoginModule sufficient;</P><P>};</P><P></P><P>AlfrescoCIFS {</P><P>&nbsp;&nbsp; com.sun.security.auth.module.Krb5LoginModule required</P><P>&nbsp;&nbsp; storeKey=true</P><P>&nbsp;&nbsp; useKeyTab=true</P><P>&nbsp;&nbsp; keyTab="/etc/keys/alfrescocifs.keytab"</P><P>&nbsp;&nbsp; principal="cifs/fs02.mydomen.local";</P><P>};</P><P></P><P>AlfrescoHTTP {</P><P>&nbsp;&nbsp; com.sun.security.auth.module.Krb5LoginModule required</P><P>&nbsp;&nbsp; storeKey=true</P><P>&nbsp;&nbsp; useKeyTab=true</P><P>&nbsp;&nbsp; keyTab="/etc/keys/alfrescohttp.keytab"</P><P>&nbsp;&nbsp; principal="HTTP/fs02.mydomen.local";</P><P>};</P><P>ShareHTTP</P><P>{</P><P>&nbsp;&nbsp; com.sun.security.auth.module.Krb5LoginModule required</P><P>&nbsp;&nbsp; storeKey=true</P><P>&nbsp;&nbsp; debug=true</P><P>&nbsp;&nbsp; useKeyTab=true</P><P>&nbsp;&nbsp; doNotPrompt=true</P><P>&nbsp;&nbsp; keyTab="/etc/keys/alfrescohttp.keytab"</P><P>&nbsp;&nbsp; principal="HTTP/fs02.mydomen.local";</P><P>};</P><P></P><P>com.sun.net.ssl.client {</P><P>&nbsp;&nbsp; com.sun.security.auth.module.Krb5LoginModule sufficient;</P><P>};</P><P></P><P>other {</P><P>&nbsp;&nbsp; com.sun.security.auth.module.Krb5LoginModule sufficient;</P><P>};</P></TD></TR></TBODY></TABLE></BLOCKQUOTE><P></P><P><STRONG>10.</STRONG> add line in file /opt/alfresco-community/java/lib/security/java.security</P><BLOCKQUOTE><TABLE border="1"><TBODY><TR><TD><P>login.config.url.1=file:${java.home}/lib/security/java.login.config</P></TD></TR></TBODY></TABLE></BLOCKQUOTE><P></P><P><STRONG>11.</STRONG> edit file /opt/alfresco-community/tomcat/shared/classes/alfresco-global.properties</P><P>add lines:</P><BLOCKQUOTE><TABLE border="1"><TBODY><TR><TD><P>authentication.chain=<STRONG>ldap1:ldap-ad,kerberos1:kerberos</STRONG></P><P></P><P>ntlm.authentication.sso.enabled = <STRONG>true</STRONG><BR />ntlm.authentication.browser.ticketLogons=true</P><P>ldap.authentication.active=<STRONG>false</STRONG><BR />ldap.authentication.userNameFormat=%s@mydomen.local<BR />ldap.authentication.allowGuestLogin=false<BR />ldap.authentication.java.naming.provider.url=ldap://dc01.mydomen.local:389<BR />ldap.authentication.defaultAdministratorUserNames=Administrator,alfresco,admin</P><P>ldap.synchronization.active=<STRONG>true</STRONG> <BR />ldap.synchronization.java.naming.security.principal=user_alfresco@mydomen.local<BR />ldap.synchronization.java.naming.security.credentials=12345678</P><P>ldap.synchronization.groupSearchBase=ou=Group,dc=mydomen,dc=local<BR />ldap.synchronization.userSearchBase=ou=user,dc=mydomen,dc=local</P><P></P><P>filesystem.domainMappings=MYDOMEN<BR />filesystem.domainMappings.value.MYDOMEN.subnet=192.168.0.0<BR />filesystem.domainMappings.value.MYDOMEN.mask=255.255.255.0</P><P></P><P>### Kerberos properties ###</P><P>kerberos.authentication.sso.enabled=<STRONG>true</STRONG><BR />kerberos.authentication.defaultAdministratorUserNames=admin<BR />kerberos.authentication.user.configEntryName=Alfresco<BR />kerberos.authentication.cifs.configEntryName=AlfrescoCIFS<BR />kerberos.authentication.cifs.password=12345678<BR />kerberos.authentication.http.configEntryName=AlfrescoHTTP<BR />kerberos.authentication.http.password=12345678<BR />kerberos.authentication.authenticateCIFS=true<BR />kerberos.authentication.realm=MYDOMEN.LOCAL<BR />kerberos.authentication.stripUsernameSuffix=true</P><P>kerberos.authentication.browser.ticketLogons=true<BR />kerberos.authentication.sso.fallback.enabled=true</P></TD></TR></TBODY></TABLE></BLOCKQUOTE><BLOCKQUOTE><TABLE border="1"><TBODY><TR><TD>ou=Group,dc=mydomen,dc=local - content group for export in Alfresco<BR />ou=user,dc=mydomen,dc=local - content user for export in Alfresco</TD></TR></TBODY></TABLE></BLOCKQUOTE><P><STRONG>12.</STRONG> cread user in controller domen</P><P>login: user_alfresco@mydomen.local</P><P>password: 12345678</P><P></P><P><STRONG>13.</STRONG> i do:</P><P>"open Active Directory Users and Computers, right click on the domain, and select 'Delegate Control...'&nbsp; Click 'Next', then select the user that you are using for the LDAP bind and click 'Next'.&nbsp; The permission that they will need is on the next screen 'Read all inetOrgPerson information.'&nbsp; "</P><P></P><P><STRONG>14.</STRONG> Edit /opt/alfresco-community/tomcat/shared/classes/alfresco/web-extension/share-config-custom.xml</P><P></P><P>Change ALFRESCO.ORG&nbsp; -&gt; MYDOMEN.LOCAL</P><P>Change servrer name of you server name</P><P>Uncomment Kerberos section</P><P></P><P></P><P>reboot server alfresco - fs02</P><P></P><P><STRONG>15.</STRONG> <SPAN lang="en">edit settings internet explorer (IE11)</SPAN></P><P><SPAN lang="en">Check Tools &gt; Internet Options &gt; Security &gt; Local Intranet</SPAN></P><P><SPAN lang="en">add domen http:/*.mydomen.local </SPAN></P><P><SPAN lang="en">Check Tools &gt; Internet Options &gt; Security &gt; Custom Level and make sure <EM>Automatic logon with current username and password</EM> is selected</SPAN></P><P></P><P></P><P></P><P></P><P><SPAN lang="en">working!!!</SPAN></P><P></P><P><SPAN lang="en">&nbsp;</SPAN></P></BODY></HTML> Thu, 27 Oct 2016 08:37:41 GMT badim 2016-10-27T08:37:41Z Config Kerberos SSO, step by step https://connect.hyland.com/t5/alfresco-archive/config-kerberos-sso-step-by-step/m-p/281020#M234150 i havems ldap - win2008r2 - mydomen.localdc01.mydomen.local - controller domenclient&nbsp; - win7alfresco server - fs02.mydomen.locala need&nbsp; step by step config kerberos!my step:1. install alfresco-community-installer-201605-linux-x64.binin directory&nbsp; /opt/alfresco-community(centos 7 - domen member)2. cr Thu, 27 Oct 2016 08:37:41 GMT https://connect.hyland.com/t5/alfresco-archive/config-kerberos-sso-step-by-step/m-p/281020#M234150 badim 2016-10-27T08:37:41Z Re: Config Kerberos, somebody, i need help https://connect.hyland.com/t5/alfresco-archive/config-kerberos-sso-step-by-step/m-p/281021#M234151 <HTML><HEAD></HEAD><BODY><P>after enter login and password? i read in log file:</P><P></P><BLOCKQUOTE><TABLE border="1"><TBODY><TR><TD><P>2016-11-01 14:05:42,821 DEBUG [org.alfresco.web.app.servlet.KerberosAuthenticationFilter] [http-apr-8080-exec-8] New Kerberos auth request from <STRONG>127.0.0.1</STRONG> (127.0.0.1:44520)</P><P>2016-11-01 14:05:42,822 DEBUG [org.alfresco.web.app.servlet.KerberosAuthenticationFilter] [http-apr-8080-exec-8] Issuing login challenge to browser.</P><P>2016-11-01 14:05:42,900 DEBUG [org.alfresco.web.app.servlet.KerberosAuthenticationFilter] [http-apr-8080-exec-9] New Kerberos auth request from <STRONG>127.0.0.1</STRONG> (127.0.0.1:44520)</P><P>2016-11-01 14:05:42,901 DEBUG [org.alfresco.web.app.servlet.KerberosAuthenticationFilter] [http-apr-8080-exec-9] Issuing login challenge to browser.</P></TD></TR></TBODY></TABLE></BLOCKQUOTE><P></P><P>ip my comp 192.168.0.32</P></BODY></HTML> Tue, 01 Nov 2016 09:11:17 GMT https://connect.hyland.com/t5/alfresco-archive/config-kerberos-sso-step-by-step/m-p/281021#M234151 badim 2016-11-01T09:11:17Z Re: Config  Kerberos,  somebody, i need help https://connect.hyland.com/t5/alfresco-archive/config-kerberos-sso-step-by-step/m-p/281022#M234152 <HTML><HEAD></HEAD><BODY><P><SPAN class="short_text" lang="en"><SPAN>really nobody</SPAN> <SPAN>understands</SPAN> <SPAN>Kerberos</SPAN></SPAN></P><P><SPAN class="short_text" lang="en"><SPAN><IMG src="https://connect.hyland.com/legacyfs/online/alfresco/emoticons/cry.png" /></SPAN></SPAN></P></BODY></HTML> Tue, 01 Nov 2016 16:45:41 GMT https://connect.hyland.com/t5/alfresco-archive/config-kerberos-sso-step-by-step/m-p/281022#M234152 badim 2016-11-01T16:45:41Z