topic Kerberos + Active Directory in Alfresco Archive https://connect.hyland.com/t5/alfresco-archive/kerberos-active-directory/m-p/291647#M244777 <HTML><HEAD></HEAD><BODY><SPAN>First… Sorry my english!!!!!!!!!</SPAN><BR /><BR /><BR /><SPAN>Hi comuninity,</SPAN><BR /><BR /><SPAN>I want to access Share automatically using Kerberos SSO with my domain users. I can access Alfresco with SSO, but not Share.</SPAN><BR /><BR /><SPAN>Servers: All the machines are in my domain MIDOMINIO.NET</SPAN><BR /><SPAN>* w2008alfresco - (Alfresco) Windows Server 2008 R2</SPAN><BR /><SPAN>* AD01 - (Active Directory) Windows Server 2008 R2</SPAN><BR /><SPAN>* clientexp - (Maquina cliente) - Windows XP SP3 / Internet Explorer 6 / Firefox 28</SPAN><BR /><SPAN>* cliente01 (Maquina cliente) - Windows 7 / Internet Explorer 11 / Firefox 28</SPAN><BR /><BR /><BR /><SPAN>1) In my active directory AD01 i create the user&nbsp; 'alfrescohttp'</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; - Not requiere previous kerberos authentication</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; - Password never expires</SPAN><BR /><BR /><SPAN>2) In active directory&nbsp; AD01 I execute</SPAN><BR /><BR /><PRE class="language-none line-numbers"><CODE>ktpass -princ HTTP/w2008alfresco.midominio.net@MIDOMINIO.NET -pass MIPASSWORD -mapuser midominio\alfrescohttp -crypto RC4-HMAC-NT -ptype KRB5_NT_PRINCIPAL -out c:\temp\alfrescohttp.keytab -kvno 0<SPAN class="line-numbers-rows"><SPAN>‍</SPAN></SPAN></CODE></PRE><BR /><BR /><SPAN>3) I copy keytab in alfresco server (w2008alfresco)</SPAN><BR /><BR /><SPAN>4) I execute in AD01</SPAN><BR /><PRE class="language-none line-numbers"><CODE> <BR />setspn -a HTTP/W2008ALFRESCO alfrescohttp<BR />setspn -a HTTP/W2008ALFRESCO.midominio.net alfrescohttp<BR /><SPAN class="line-numbers-rows"><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN></SPAN></CODE></PRE><BR /><BR /><SPAN>5) Configuration&nbsp; C:\Windows\krb5.ini (Server w2008alfresco)</SPAN><BR /><PRE class="language-none line-numbers"><CODE><BR />[libdefaults]<BR />default_realm = MIDOMINIO.NET<BR />default_tkt_enctypes = rc4-hmac<BR />default_tgs_enctypes = rc4-hmac<BR /><BR />[realms]<BR />MIDOMINIO.NET = {<BR />&nbsp;&nbsp; kdc = ad01.midominio.net<BR />&nbsp;&nbsp; admin_server = ad01.midominio.net<BR />}<BR /><BR />[domain_realm]<BR />ad01.midominio.net = MIDOMINIO.NET<BR />.ad01.midominio.net = MIDOMINIO.NET<BR /><SPAN class="line-numbers-rows"><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN></SPAN></CODE></PRE><BR /><BR /><SPAN>6) I create java.login.config in C:/Alfresco/java/jre/lib/security (w2008alfresco machine)</SPAN><BR /><BR /><PRE class="language-none line-numbers"><CODE><BR />Alfresco {<BR />&nbsp;&nbsp; com.sun.security.auth.module.Krb5LoginModule sufficient;<BR />};<BR /><BR />AlfrescoHTTP<BR />{<BR />&nbsp;&nbsp; com.sun.security.auth.module.Krb5LoginModule required<BR />&nbsp;&nbsp; storeKey=true<BR />&nbsp;&nbsp; useKeyTab=true<BR />&nbsp;&nbsp; keyTab="C:/Alfresco/keytab/alfrescohttp.keytab"<BR />&nbsp;&nbsp; principal="HTTP/W2008ALFRESCO.midominio.net";<BR />};<BR /><BR />ShareHTTP<BR />{<BR />&nbsp;&nbsp; com.sun.security.auth.module.Krb5LoginModule required<BR />&nbsp;&nbsp; storeKey=true<BR />&nbsp;&nbsp; useKeyTab=true<BR />&nbsp;&nbsp; keyTab="C:/Alfresco/keytab/alfrescohttp.keytab"<BR />&nbsp;&nbsp; principal="HTTP/W2008ALFRESCO.midominio.net";<BR />};<BR /><BR />com.sun.net.ssl.client {<BR />&nbsp;&nbsp; com.sun.security.auth.module.Krb5LoginModule sufficient;<BR />};<BR /><BR />other {<BR />&nbsp;&nbsp; com.sun.security.auth.module.Krb5LoginModule sufficient;<BR />};<BR /><SPAN class="line-numbers-rows"><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN></SPAN></CODE></PRE><BR /><BR /><SPAN>7) I change the line in file C:/Alfresco/java/jre/lib/security/java.security (w2008alfresco machine)</SPAN><BR /><PRE class="language-none line-numbers"><CODE><BR />login.config.url.1=file:C:/Alfresco/java/jre/lib/security/java.login.config<BR /><SPAN class="line-numbers-rows"><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN></SPAN></CODE></PRE><BR /><BR /><SPAN>Add the sities </SPAN><A href="http://w2008alfresco" rel="nofollow noopener noreferrer">http://w2008alfresco</A><SPAN> and </SPAN><A href="http://w2008alfresco.midominio.net" rel="nofollow noopener noreferrer">http://w2008alfresco.midominio.net</A><SPAN> in internet explorer. Intranet zone on the client machines. Login automatic with name and password checked.</SPAN><BR /><BR /><SPAN><span class="lia-unicode-emoji" title=":smiling_face_with_sunglasses:">😎</span> Rename the file share-config-custom.xml.sample to share-config-custom.xml</SPAN><BR /><BR /><SPAN>9) Uncomment the "Remote" seccions</SPAN><BR /><BR /><SPAN>10) Replace KerberosDisables to Kerberos with the next data</SPAN><BR /><BR /><PRE class="language-none line-numbers"><CODE><BR />&lt;config evaluator="string-compare" condition="Kerberos" replace="true"&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;kerberos&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;password&gt;MIPASSWORD&lt;/password&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;realm&gt;MIDOMINIO.NET&lt;/realm&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;endpoint-spn&gt;HTTP/w2008ALFRESCO.midominio.net@MIDOMINIO.NET&lt;/endpoint-spn&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;config-entry&gt;ShareHTTP&lt;/config-entry&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;/kerberos&gt;<BR />&nbsp;&nbsp; &lt;/config&gt;<BR /><SPAN class="line-numbers-rows"><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN></SPAN></CODE></PRE><BR /><BR /><SPAN>11) In active directory, in the user alfrescohttop properties, i checked "Trust this user for delegation to any service (Kerberos only)"</SPAN><BR /><BR /><SPAN>12) Firefox configuration</SPAN><BR /><PRE class="language-none line-numbers"><CODE>network.negotiate-auth.delegation-uris<BR />network.negotiate-auth.trusted-uris<BR />network.negotiate-auth.using-native-gsslib<SPAN class="line-numbers-rows"><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN></SPAN></CODE></PRE><BR /><BR /><SPAN>13) alfresco.properties</SPAN><BR /><PRE class="language-none line-numbers"><CODE><BR />authentication.chain=kerberos1:kerberos,alfrescoNtlm1:alfrescoNtlm<BR /><BR />kerberos.authentication.realm=MIDOMINIO.NET<BR />kerberos.authentication.sso.enabled=true<BR /><BR />kerberos.authentication.authenticateCIFS=false<BR />kerberos.authentication.user.configEntryName=Alfresco<BR />kerberos.authentication.http.configEntryName=AlfrescoHTTP<BR />kerberos.authentication.http.password=MIPASSWORD<BR />kerberos.authentication.defaultAdministratorUserNames=admin<BR />kerberos.authentication.stripUsernameSuffix=true<BR /><SPAN class="line-numbers-rows"><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN></SPAN></CODE></PRE><BR /><BR /><SPAN>When i want to access, a dialog appears and the log is:</SPAN><BR /><BR /><PRE class="language-none line-numbers"><CODE><BR /> Search Subject for Kerberos V5 ACCEPT cred (HTTP/W2008ALFRESCO.midominio.net@MIDOMINIO.NET, sun.security.jgss.krb5.Krb5AcceptCredential)<BR />Found KeyTab<BR />Found KerberosKey for HTTP/W2008ALFRESCO.midominio.net@MIDOMINIO.NET<BR />Entered Krb5Context.acceptSecContext with state=STATE_NEW<BR />Added key: 23version: 0<BR />Ordering keys wrt default_tkt_enctypes list<BR />default etypes for default_tkt_enctypes: 23.<BR />&gt;&gt;&gt; EType: sun.security.krb5.internal.crypto.ArcFourHmacEType<BR />Using builtin default etypes for permitted_enctypes<BR />default etypes for permitted_enctypes: 17 16 23 1 3.<BR />&gt;&gt;&gt; EType: sun.security.krb5.internal.crypto.ArcFourHmacEType<BR />System time adjusted<BR />object 0: 1398444344146/146721<BR />replay cache found.<BR />&gt;&gt;&gt; KrbApReq: authenticate succeed.<BR />Krb5Context setting peerSeqNumber to: 1290115219<BR />&gt;&gt;&gt; EType: sun.security.krb5.internal.crypto.ArcFourHmacEType<BR />Krb5Context setting mySeqNumber to: 75067258<BR />2014-04-25 13:45:44,053&nbsp; WARN&nbsp; [site.servlet.KerberosSessionSetupPrivilegedAction] [http-apr-8080-exec-9] credentials can not be delegated!<BR /><SPAN class="line-numbers-rows"><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN></SPAN></CODE></PRE><BR /></BODY></HTML> Fri, 25 Apr 2014 17:06:25 GMT emelbye 2014-04-25T17:06:25Z Kerberos + Active Directory https://connect.hyland.com/t5/alfresco-archive/kerberos-active-directory/m-p/291647#M244777 First… Sorry my english!!!!!!!!!Hi comuninity,I want to access Share automatically using Kerberos SSO with my domain users. I can access Alfresco with SSO, but not Share.Servers: All the machines are in my domain MIDOMINIO.NET* w2008alfresco - (Alfresco) Windows Server 2008 R2* AD01 - (Active Direct Fri, 25 Apr 2014 17:06:25 GMT https://connect.hyland.com/t5/alfresco-archive/kerberos-active-directory/m-p/291647#M244777 emelbye 2014-04-25T17:06:25Z Re: Kerberos + Active Directory https://connect.hyland.com/t5/alfresco-archive/kerberos-active-directory/m-p/291648#M244778 <HTML><HEAD></HEAD><BODY><SPAN>I think you are missing share-config-custom.xml configuration on Share. Take a look at </SPAN><A href="http://docs.alfresco.com/4.2/index.jsp?topic=%2Fcom.alfresco.enterprise.doc%2Ftasks%2Fauth-kerberos-shareSSO.html" rel="nofollow noopener noreferrer">http://docs.alfresco.com/4.2/index.jsp?topic=%2Fcom.alfresco.enterprise.doc%2Ftasks%2Fauth-kerberos-shareSSO.html</A></BODY></HTML> Mon, 05 May 2014 15:48:06 GMT https://connect.hyland.com/t5/alfresco-archive/kerberos-active-directory/m-p/291648#M244778 angelborroy 2014-05-05T15:48:06Z Re: Kerberos + Active Directory https://connect.hyland.com/t5/alfresco-archive/kerberos-active-directory/m-p/291649#M244779 <HTML><HEAD></HEAD><BODY><SPAN>I did…. </SPAN><BR /><BR /><SPAN>I didnt write the remote sections here. They are same as the </SPAN><A href="http://docs.alfresco.com/4.2/index.jsp?topic=%2Fcom.alfresco.enterprise.doc%2Ftasks%2Fauth-kerberos-shareSSO.html" rel="nofollow noopener noreferrer">http://docs.alfresco.com/4.2/index.jsp?topic=%2Fcom.alfresco.enterprise.doc%2Ftasks%2Fauth-kerberos-shareSSO.html</A><SPAN> page.</SPAN><BR /><BR /><SPAN>In my first post</SPAN><BR /><BR /><SPAN>Quote:</SPAN><BR /><BR /><SPAN><span class="lia-unicode-emoji" title=":smiling_face_with_sunglasses:">😎</span> Rename the file share-config-custom.xml.sample to share-config-custom.xml</SPAN><BR /><BR /><SPAN>9) Uncomment the "Remote" seccions</SPAN><BR /><BR /><SPAN>10) Replace KerberosDisables to Kerberos with the next data</SPAN><BR /><PRE class="language-none line-numbers"><CODE><BR />&lt;config evaluator="string-compare" condition="Kerberos" replace="true"&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;kerberos&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;password&gt;MIPASSWORD&lt;/password&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;realm&gt;MIDOMINIO.NET&lt;/realm&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;endpoint-spn&gt;HTTP/w2008ALFRESCO.midominio.net@MIDOMINIO.NET&lt;/endpoint-spn&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;config-entry&gt;ShareHTTP&lt;/config-entry&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;/kerberos&gt;<BR />&nbsp;&nbsp; &lt;/config&gt;<BR /><SPAN class="line-numbers-rows"><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN></SPAN></CODE></PRE></BODY></HTML> Mon, 05 May 2014 17:47:36 GMT https://connect.hyland.com/t5/alfresco-archive/kerberos-active-directory/m-p/291649#M244779 emelbye 2014-05-05T17:47:36Z Re: Kerberos + Active Directory https://connect.hyland.com/t5/alfresco-archive/kerberos-active-directory/m-p/291650#M244780 <HTML><HEAD></HEAD><BODY><P>I have the same issue on alfresco 4.1.4. Did you ever get this sorted?!</P></BODY></HTML> Thu, 16 May 2019 16:46:11 GMT https://connect.hyland.com/t5/alfresco-archive/kerberos-active-directory/m-p/291650#M244780 shocko 2019-05-16T16:46:11Z