Authentication Api

carlosjl — Thu, 19 Dec 2013 20:49:51 GMT

Hello!My environment is composed of Alfresco 3.4 Community Edition and I integrated with SSO Jasig Cas Server.The users authenticate without problem and users that do not exist are self-created (createmissinpeople).But, I have a problem when I access to url http://my.alfresco.com/alfresco/api . I ca

Re: Authentication Api

mrogers — Thu, 19 Dec 2013 23:59:41 GMT

Lots more details please. What's your authentication configuration. How do you expect pepe to authenticate?

And are you really trying to connect to my.alfresco.com?

Re: Authentication Api

mrogers — Thu, 19 Dec 2013 23:59:41 GMT

Lots more details please. What's your authentication configuration. How do you expect pepe to authenticate?

And are you really trying to connect to my.alfresco.com?

Re: Authentication Api

carlosjl — Fri, 20 Dec 2013 09:19:16 GMT

Hi! mrogers, thank you for quick response.

My authentication configuration is:

-. alfresco-global.properties
## Enable CAS Authentication (External subsystem)###
external.authentication.enabled=true
authentication.chain=cas:external,alfrescoNtlm1:alfrescoNtlm
external.authentication.defaultAdministratorUserNames=adminenterprise

-. share-config-custom.xml

<!– Custom Config to Cas –>

   <config evaluator="string-compare" condition="Remote">
      <remote>

         <connector>
            <id>alfrescoCookie</id>
            <name>Alfresco Connector</name>
            <description>Connects to an Alfresco instance using cookie-based authentication</description>
            <class>org.springframework.extensions.webscripts.connector.AlfrescoConnector</class>
         </connector>

         <endpoint>
            <id>alfresco</id>
            <name>Alfresco - user access</name>
            <description>Access to Alfresco Repository WebScripts that require user authentication</description>
            <connector-id>alfrescoCookie</connector-id>
            <endpoint-url>http://www.myenterprise.org/bollo/funfu/alfresco/wcs</endpoint-url>
            <identity>user</identity>
            <external-auth>true</external-auth>
         </endpoint>
      </remote>
   </config>

-. Alfresco Explorer (web.xml)

<!– CAS Loguin –>
   <filter>
      <filter-name>CAS Authentication Filter</filter-name>
      <filter-class>org.jasig.cas.client.authentication.AuthenticationFilter</filter-class>
      <init-param>
         <param-name>casServerLoginUrl</param-name>
         <param-value>https://www.myenterprise.org/education/nosh/cas/login</param-value>
      </init-param>
      <init-param>
         <param-name>serverName</param-name>
         <param-value>http://www.myenterprise.org/bollo/funfu/alfresco</param-value>
      </init-param>
   </filter>
   <filter>
      <filter-name>CAS Validation Filter</filter-name>
      <filter-class>org.jasig.cas.client.validation.Cas10TicketValidationFilter</filter-class>
      <init-param>
         <param-name>casServerUrlPrefix</param-name>
         <param-value>https://www.myenterprise.org/education/nosh/cas/login</param-value>
      </init-param>
      <init-param>
         <param-name>serverName</param-name>
         <param-value>http://www.myenterprise.org/bollo/funfu/alfresco</param-value>
      </init-param>
   </filter>
   <filter>
      <filter-name>CAS HttpServletRequest Wrapper Filter</filter-name>
      <filter-class>org.jasig.cas.client.util.HttpServletRequestWrapperFilter</filter-class>
   </filter>
<!—->

<!– CAS Login–>
   <filter-mapping>
      <filter-name>CAS Authentication Filter</filter-name>
      <url-pattern>/faces/*</url-pattern>
   </filter-mapping>
   <filter-mapping>
      <filter-name>CAS Validation Filter</filter-name>
      <url-pattern>/faces/*</url-pattern>
   </filter-mapping>
   <filter-mapping>
      <filter-name>CAS HttpServletRequest Wrapper Filter</filter-name>
      <url-pattern>/faces/*</url-pattern>
   </filter-mapping>

   <filter-mapping>
      <filter-name>CAS Authentication Filter</filter-name>
      <url-pattern>/navigate/*</url-pattern>
   </filter-mapping>
   <filter-mapping>
      <filter-name>CAS Validation Filter</filter-name>
      <url-pattern>/navigate/*</url-pattern>
   </filter-mapping>
   <filter-mapping>
      <filter-name>CAS HttpServletRequest Wrapper Filter</filter-name>
      <url-pattern>/navigate/*</url-pattern>
   </filter-mapping>

   <filter-mapping>
      <filter-name>CAS Authentication Filter</filter-name>
      <url-pattern>/command/*</url-pattern>
   </filter-mapping>
   <filter-mapping>
      <filter-name>CAS Validation Filter</filter-name>
      <url-pattern>/command/*</url-pattern>
   </filter-mapping>
   <filter-mapping>
      <filter-name>CAS HttpServletRequest Wrapper Filter</filter-name>
      <url-pattern>/command/*</url-pattern>
   </filter-mapping>

   <filter-mapping>
      <filter-name>CAS Authentication Filter</filter-name>
      <url-pattern>/download/*</url-pattern>
   </filter-mapping>
   <filter-mapping>
      <filter-name>CAS Validation Filter</filter-name>
      <url-pattern>/download/*</url-pattern>
   </filter-mapping>
   <filter-mapping>
      <filter-name>CAS HttpServletRequest Wrapper Filter</filter-name>
      <url-pattern>/download/*</url-pattern>
   </filter-mapping>

   <filter-mapping>
      <filter-name>CAS Authentication Filter</filter-name>
      <url-pattern>/template/*</url-pattern>
   </filter-mapping>
   <filter-mapping>
      <filter-name>CAS Validation Filter</filter-name>
      <url-pattern>/template/*</url-pattern>
   </filter-mapping>
   <filter-mapping>
<filter-mapping>
      <filter-name>CAS Authentication Filter</filter-name>
      <url-pattern>/n/*</url-pattern>
   </filter-mapping>
   <filter-mapping>
      <filter-name>CAS Validation Filter</filter-name>
      <url-pattern>/n/*</url-pattern>
   </filter-mapping>
   <filter-mapping>
      <filter-name>CAS HttpServletRequest Wrapper Filter</filter-name>
      <url-pattern>/n/*</url-pattern>
   </filter-mapping>

   <filter-mapping>
      <filter-name>CAS Authentication Filter</filter-name>
      <url-pattern>/c/*</url-pattern>
   </filter-mapping>
   <filter-mapping>
      <filter-name>CAS Validation Filter</filter-name>
      <url-pattern>/c/*</url-pattern>
   </filter-mapping>
   <filter-mapping>
      <filter-name>CAS HttpServletRequest Wrapper Filter</filter-name>
      <url-pattern>/c/*</url-pattern>
   </filter-mapping>

   <filter-mapping>
      <filter-name>CAS Authentication Filter</filter-name>
      <url-pattern>/t/*</url-pattern>
   </filter-mapping>
   <filter-mapping>
      <filter-name>CAS Validation Filter</filter-name>
      <url-pattern>/t/*</url-pattern>
   </filter-mapping>
   <filter-mapping>
      <filter-name>CAS HttpServletRequest Wrapper Filter</filter-name>
      <url-pattern>/t/*</url-pattern>
   </filter-mapping>

   <filter-mapping>
      <filter-name>CAS Authentication Filter</filter-name>
      <url-pattern>/d/*</url-pattern>
   </filter-mapping>
   <filter-mapping>
      <filter-name>CAS Validation Filter</filter-name>
      <url-pattern>/d/*</url-pattern>
   </filter-mapping>
   <filter-mapping>
      <filter-name>CAS HttpServletRequest Wrapper Filter</filter-name>
      <url-pattern>/d/*</url-pattern>
   </filter-mapping>
<!—->

-. Share (web.xml)

<!– CAS Loguin –>
   <filter>
      <filter-name>CAS Authentication Filter</filter-name>
      <filter-class>org.jasig.cas.client.authentication.AuthenticationFilter</filter-class>
      <init-param>
         <param-name>casServerLoginUrl</param-name>
         <param-value>https://www.myenterprise.org/education/nosh/cas/login</param-value>
      </init-param>
      <init-param>
         <param-name>serverName</param-name>
         <param-value>http://www.myenterprise.org/bollo/funfu/share</param-value>
      </init-param>
   </filter>
   <filter>
      <filter-name>CAS Validation Filter</filter-name>
      <filter-class>org.jasig.cas.client.validation.Cas10TicketValidationFilter</filter-class>
      <init-param>
         <param-name>casServerUrlPrefix</param-name>
         <param-value>https://www.myenterprise.org/education/nosh/cas/login</param-value>
      </init-param>
      <init-param>
         <param-name>serverName</param-name>
         <param-value>http://www.myenterprise.org/bollo/funfu/share</param-value>
      </init-param>
   </filter>
   <filter>
      <filter-name>CAS HttpServletRequest Wrapper Filter</filter-name>
      <filter-class>org.jasig.cas.client.util.HttpServletRequestWrapperFilter</filter-class>
   </filter>
<!– /CAS –>

<!– CAS –>
   <filter-mapping>
      <filter-name>CAS Authentication Filter</filter-name>
      <url-pattern>/*</url-pattern>
   </filter-mapping>

   <filter-mapping>
      <filter-name>CAS Validation Filter</filter-name>
      <url-pattern>/*</url-pattern>
   </filter-mapping>

   <filter-mapping>
      <filter-name>CAS HttpServletRequest Wrapper Filter</filter-name>
      <url-pattern>/*</url-pattern>
   </filter-mapping>
<!– /CAS –>

Tell me if you need more information.
Thank's for all.

Re: Authentication Api

mrogers — Fri, 20 Dec 2013 12:17:29 GMT

The problem is that the login WebScript is working with username / password. Rather than the sso token which is generated by your cas server.

Can you add something to the authentication chain (such as an ldap connection) to allow username/ password validation for your external users? In addition it would be worth studying how share sso authentication works, somehow it calls web scripts with sso ( unfortunately I don't personally know about that) so there may be another way to run a WebScript or getting a ticket.

topic Re: Authentication Api in Alfresco Archive

Authentication Api

Re: Authentication Api

Re: Authentication Api

Re: Authentication Api

Re: Authentication Api