topic Re: Allow CIFS access to synced users only in Alfresco Archive

Allow CIFS access to synced users only

davidyg — Wed, 29 Jan 2014 13:12:01 GMT

Hello:I have configured Alfresco authentication using Kerberos and LDAP-AD as chained subsystems. Kerberos is used to authenticate HTTP and CIFS access and LDAP-AD to sync users data (retrieved from AD).I have disabled SSO too so if you try to login (Share) using a not synced user it is not recogniz

Re: Allow CIFS access to synced users only

mrogers — Wed, 29 Jan 2014 13:33:00 GMT

Directory sync is a separate process from authentication. Therefore syncing user properties has no effect upon who can or can't log in.

There may be authentication settings you can use. So the first thing to look at and understand is your authentication chain, and any other authentication settings.

I suspect you may want to turn off authentication via ldap-ad

Re: Allow CIFS access to synced users only

davidyg — Wed, 29 Jan 2014 14:47:00 GMT

Ok, thanks. I really suspected that. But I'm still looking for an option to avoid what I said.

Configured authentication chain is:

authentication.chain=kerberos1:kerberos,ldap-ad1:ldap-ad‍

And the relevant options are:

ldap.authentication.active=false
ldap.synchronization.active=true‍‍

kerberos.authentication.authenticateCIFS=true
kerberos.authentication.sso.enabled=false‍‍

These options are set in files under extension directory.

I think the rest of settings (domain, realm, users synced and so on) are working fine. I can login and sync user data from AD without problems.

If I understand you correctly, these options:

synchronization.syncWhenMissingPeopleLogIn=false
synchronization.autoCreatePeopleOnLogin=false‍‍

Are only important if you use LDAP-AD to authenticate and not only to synchronize.

But then all domain users (synced and not synced) could login to Share. And that's not what I get now. If I try to login directly with a not synced user, it is rejected. Anyhow, I will test it more thoroughly to check if I'm wrong.