topic Re: Unable to logon in Alfresco Community Server after upgrading iOS Alfresco App to version 2.0 in Alfresco Archive

Unable to logon in Alfresco Community Server after upgrading iOS Alfresco App to version 2.0

jeesee — Thu, 10 Jul 2014 08:56:23 GMT

I'm having a problem after (automatic) upgrading the Alfresco App today.Yesterday with the "old" Alfresco App (black icon) on my iPhone and iPad it all works fine.Today I started the iPad app (it was automatically upgraded on both my iPhone and iPad to the 'white' icon) I receive a Session Error.I t

Re: Unable to logon in Alfresco Community Server after upgrading iOS Alfresco App to version 2.0

marc_dubresson — Thu, 10 Jul 2014 09:14:58 GMT

Hi Jeesee,

The team suggests that the sevice document should simply be: /alfresco

I also wanted to point out for the benefit of everyone that if you have an issue getting back on your cloud account after the update you can simple swipe the account name left to delete it and add it again.

Regards,

Re: Unable to logon in Alfresco Community Server after upgrading iOS Alfresco App to version 2.0

jeesee — Thu, 10 Jul 2014 13:41:51 GMT

Thank you Marc for your reply.
I changed the Service Document, but still the Failure to authenticate-error..
It also isn't on my cloud account, but on the connection to an Alfresco Community Edition 4.2f server, which worked perfectly before the app-update..

Re: Unable to logon in Alfresco Community Server after upgrading iOS Alfresco App to version 2.0

mikeh — Thu, 10 Jul 2014 13:48:12 GMT

I notice you're connecting directly to Tomcat (presumably?) on port 8443. Does that have a valid SSL certificate assigned to it? We no longer allow SSL connections with untrusted certificates due to customer concerns fed back to us from the previous app.

If that is the case, you'll either need to provision the correct SSL certificate, or use an HTTP connection.

Thanks,
Mike

Re: Unable to logon in Alfresco Community Server after upgrading iOS Alfresco App to version 2.0

jeesee — Thu, 10 Jul 2014 13:50:55 GMT

Thank you Mike, that can be the issue..
But how can I configure a correct SSL certificate to my Alfresco Tomcat installation? Can it be a self-signed certificate?

Re: Unable to logon in Alfresco Community Server after upgrading iOS Alfresco App to version 2.0

mikeh — Thu, 10 Jul 2014 18:33:37 GMT

No, sorry - it's self-signed certificates (and expired certificates) that we explicitly disallow. The "allow untrusted SSL" user preference was quite unpopular and so we didn't reimplement it in 2.0. Besides, if it's self-signed, there's very little benefit so you might as well be using HTTP anyway.

It's fairly easy to purchase and install a certificate for your Tomcat server (or Apache web server; I have a test Apache server that proxies to a development repo setup with SSL).

Thanks,
Mike

Re: Unable to logon in Alfresco Community Server after upgrading iOS Alfresco App to version 2.0

lucasolferino — Fri, 11 Jul 2014 07:34:30 GMT

I have the same problem, but in my case I use a Reverse Proxy Apache, with a validi certificate suggestions?

thank you

Re: Unable to logon in Alfresco Community Server after upgrading iOS Alfresco App to version 2.0

mikeh — Fri, 11 Jul 2014 17:46:00 GMT

Make sure your Tomcat Connector has the appropriate proxy attributes added, here's mine as an example:


    <Connector port="8090" protocol="HTTP/1.1" 
              connectionTimeout="20000" 
              redirectPort="8443" URIEncoding="UTF-8"
              scheme="https"
              proxyName="alfresco.mikehatfield.net" proxyPort="443" />
‍‍‍‍‍‍‍

This ensures CMIS generates the correct absolute URLs in the responses.

Thanks,
Mike

Re: Unable to logon in Alfresco Community Server after upgrading iOS Alfresco App to version 2.0

mikeh — Fri, 11 Jul 2014 17:48:23 GMT

Could I ask why you need a self-signed certificate to access your server? Perhaps that will help us understand the requirements.

Thanks,
Mike

Re: Unable to logon in Alfresco Community Server after upgrading iOS Alfresco App to version 2.0

pflaeging — Tue, 15 Jul 2014 06:55:38 GMT

I've got the same problem with a cacert certificate where the root certificate is correct deployed in the iOS profile. Every other service is working except Alfresco for iOS 2.0!

Re: Unable to logon in Alfresco Community Server after upgrading iOS Alfresco App to version 2.0

mikeh — Tue, 15 Jul 2014 20:46:11 GMT

When you say "every other service" - is that other third party apps, or just the built-in iOS apps? I've definitely heard of limitations regarding non-Apple apps and custom root certificates. I had success testing with a Comodo certificate (and with local CA-generated client certificates)

Thanks,
Mike

Re: Unable to logon in Alfresco Community Server after upgrading iOS Alfresco App to version 2.0

gerardh — Thu, 17 Jul 2014 07:12:38 GMT

Some more quoted text:
<blockquote>

No, sorry - it's self-signed certificates (and expired certificates) that we explicitly disallow. The "allow untrusted SSL" user preference was quite unpopular and so we didn't reimplement it in 2.0. Besides, if it's self-signed, there's very little benefit so you might as well be using HTTP anyway.

It's fairly easy to purchase and install a certificate for your Tomcat server (or Apache web server; I have a test Apache server that proxies to a development repo setup with SSL).
</blockquote>

I have a dynamic ip-adres which is provided by my isp. So a signed ssl certificate would not work because of the ip changes. Besides not to offend you, but do you know the difference between HTTPS en HTTP? A self-signed certificate can be accepted so that i decide it's safe. Then i can use the https connection and all my communication will be encrypted. Using http i lose this ability and even the login / password data will be send unencrypted.

So yes i would like to use https but not pay $60 for a ssl certificate.

But what is the reason you would not implement a feature which you already had?

Re: Unable to logon in Alfresco Community Server after upgrading iOS Alfresco App to version 2.0

ulus — Thu, 17 Jul 2014 20:42:07 GMT

Hello,
after upgrade to new iOS App authentication failture. Alfresco is behind nginx reverse proxy.
SSL <> nginx (valid Startcom Cert.) <> tomcat:8080 - Alfresco 4.2c
Worked without problems before.

Regards

Re: Unable to logon in Alfresco Community Server after upgrading iOS Alfresco App to version 2.0

mikeh — Thu, 17 Jul 2014 21:12:00 GMT

I'm unclear as to why you can't assign an SSL certificate to your particular setup… TLS has supported IP address changes for a number of years now via the SNI extension [1]; supported by all browsers except Android 2.x and MSIE on Windows XP. There are many services that support dynamic DNS for people such as yourself who cannot obtain a static IP address, http://www.dtdns.com/ is just one.

So yes i would like to use https but not pay $60 for a ssl certificate.

Personally I think it's a small price to pay for security compared to the value you're getting from an Alfresco repository and mobile apps. We may just need to agree to differ on that one.

But what is the reason you would not implement a feature which you already had?

That's a fair question. The previous iOS apps were based on code that one of our partners (Zia) originally wrote. Whilst it gave us a huge boost in getting a mobile app to market, the architecture & design of the app wasn't quite to our liking, including inheriting some features we wouldn't necessarily have added by choice. One of those was giving the end user the ability to switch off SSL validation. We had some very strong feedback from some of our larger enterprise customers that this was extremely undesirable. Fast-forwarding to our iOS 2.0 app, this was a complete re-write on top of ObjectiveCMIS and the Alfresco iOS SDK. When choosing what features to prioritise (or exclude) we looked back at all the customer feedback and that one stood out particularly. Hence why it's not in the app today.

On a more positive note, I have been actively thinking of how we can support self-signed certificates in the future. The SDK already allows this as a runtime parameter, so it's just our "out of the box" app that enforces the policy. Clearly we need an Alfresco admin to allow untrusted connections via some policy, but it's somewhat of a "chicken and egg" problem as you need the app to connect to the repository in order to retrieve the policy setting. As I said, I have some ideas as to how this could work for all parties, but I can't guarantee when the store app will allow it.

Thanks,
Mike

[1] http://en.wikipedia.org/wiki/Server_Name_Indication

P.S. Yes, I'm fully aware of the difference between http and https, but thanks for checking 😉

Re: Unable to logon in Alfresco Community Server after upgrading iOS Alfresco App to version 2.0

mikeh — Thu, 17 Jul 2014 21:16:02 GMT

Please see my comment above about the Tomcat connector. You'll likely need to proxy to a separate connector (i.e. on a different port) that has the proxy attributes set.

Note: The main reason everyone is having problems is due to the CMIS endpoint change from our webscript CMIS implementation (at /service/cmis) to the more performant OpenCMIS implementation (/cmisatom).

Thanks,
Mike

Re: Unable to logon in Alfresco Community Server after upgrading iOS Alfresco App to version 2.0

ulus — Fri, 18 Jul 2014 07:51:38 GMT

Perfect.
Thx a lot.

Best Regards

Re: Unable to logon in Alfresco Community Server after upgrading iOS Alfresco App to version 2.0

lucasolferino — Wed, 23 Jul 2014 07:31:12 GMT

Thank you, your solution work.

Luca

Re: Unable to logon in Alfresco Community Server after upgrading iOS Alfresco App to version 2.0

mikeh — Wed, 23 Jul 2014 08:12:12 GMT

Thanks for the follow-up confirmation Luca.

Mike

Re: Unable to logon in Alfresco Community Server after upgrading iOS Alfresco App to version 2.0

vrugginkj — Thu, 24 Jul 2014 07:12:00 GMT

Hello,

We've got a valid certificate from UserTrust Legacy.

Since the update to Mobile 2.0, w've the same problem.
Our technical consultant thinks that the wildcard might be the problem (*.ourdomain.xx)

Any idea ?

PS, The application FreshDocs from ZIA still works fine…

Alfresco 4.2.e

Re: Unable to logon in Alfresco Community Server after upgrading iOS Alfresco App to version 2.0

x1m — Mon, 04 Aug 2014 22:13:08 GMT

Hi ulus,

What changes did you make to make it work with nginx?

Best Regards,