share external auth header ignored

aaron_bru — Wed, 07 Aug 2013 21:31:30 GMT

Hi all, trying to use external auth with share in 4.2.c with tomcat 7.Explorer is working fine, but whenever share trys to login, it requests this:127.0.0.1 - - [07/Aug/2013:16:52:35 -0400] "GET /alfresco/wcs/touch HTTP/1.1" 302 127.0.0.1 - - [07/Aug/2013:16:52:35 -0400] "GET /alfresco/faces/jsp/log

Re: share external auth header ignored

aaron_bru — Thu, 08 Aug 2013 18:27:19 GMT

I've done quite a lot more debugging on this, here's what I posted on IRC about it: (apparently to myself

aaron-bru   seems like the problem is in org.alfresco.web.app.servlet.AuthenticationHelper.getRemoteUserMapper(), debug error message "No active remote user mapper.", which the code shows will result in…
   aaron-bru   …a redirect to login page. How can I fix this?
   aaron-bru   org.alfresco.web.app.servlet.DefaultRemoteUserMapper.getRemoteUser() does read the correct header, but then it ignores it for some reason, not sure if this is a bug or not
   aaron-bru   looks like its because proxyUserName is alfresco-system instead of null, even though I have external.authentication.proxyUserName=
   aaron-bru   How can I set proxyUserName to null?
   aaron-bru   I set it to null in the debugger and was able to login successfully, so I know its the problem
   aaron-bru   the value from the config file is not being set into DefaultRemoteUserMapper, the function setProxyHeader in the source
   aaron-bru   …is never called
   aaron-bru   hm seems like I have no choice but to modify the code…any ideas?

I've tried setting proxyUserName=something but something never shows up in DefaultRemoteUserMapper.proxyUserName Is this a bug?

My alfresco/WEB-INF/classes/alfresco/subsystems/Authentication/external/external-filter-context.xml
has
<blockcode>
<bean id="remoteUserMapper" class="org.alfresco.web.app.servlet.DefaultRemoteUserMapper">
      <property name="proxyUserName">
         <value>${external.authentication.proxyUserName}</value>
      </property>
</blockcode>
…
in it, and my tomcat/shared/classes/alfresco/extension/external1/external-authentication.properties
has
<blockcode>
external.authentication.enabled=true
external.authentication.proxyUserName=
external.authentication.proxyHeader=X-Alfresco-Remote-User
</blockcode>
How come proxyUserName is not being set?

Re: share external auth header ignored

aaron_bru — Thu, 08 Aug 2013 19:11:02 GMT

Turns out alfresco was ignoring my
tomcat/shared/classes/alfresco/extension/external1/external-authentication.properties
Moved everything to alfresco-global.properties and it worked. My fault for not checking that sooner.

But the question still remains why that property file was being ignored, I believe I set it up as the docs indicate. I'm using
authentication.chain=external1:external,alfrescoNtlm1:alfrescoNtlm

topic share external auth header ignored in Alfresco Archive

share external auth header ignored

Re: share external auth header ignored

Re: share external auth header ignored