topic Re: authentication problems 2.0.2 in Alfresco Archive

authentication problems 2.0.2

boston — Fri, 17 Oct 2014 08:41:28 GMT

Hi,I have installed Alfresco server 4.2.e. When connecting from mobile client v. 2.0.1 (iOS) everything is OK. But with mobile client v. 2.0.2 got authentication problem. How could I fix it?Thanx!

Re: authentication problems 2.0.2

gavinc — Fri, 17 Oct 2014 19:46:01 GMT

Sorry to hear that you're having connection issues.

Using a REST client, could you also please try the following URLs: hostort/alfresco/service/api/server and also hostort/alfresco/cmisatom and post the response you receive.

Re: authentication problems 2.0.2

nishantqwerty — Sun, 19 Oct 2014 22:21:16 GMT

I am facing the same issue.
I tried the URLs listed above but they didn't work as well.
This issue is occuring for Alfresco Servers that have Active Directory integration.

Re: authentication problems 2.0.2

boston — Mon, 20 Oct 2014 07:10:00 GMT

Hi,
first link displays this:
{
   "data":
   {
      "edition": "Community",
      "version": "4.2.0 (r56674-b4848)",
      "schema": "6033"
   }
}

And another link let me download some .xml file {cmisatom.xml}

**
What is that for?

Re: authentication problems 2.0.2

mikeh — Mon, 20 Oct 2014 09:46:04 GMT

Can you clarify "didn't work" please - it doesn't give us much to go on otherwise.

Thanks,
Mike

Re: authentication problems 2.0.2

gavinc — Mon, 20 Oct 2014 09:48:03 GMT

When you say the URLs don't work do you mean you get a non 200 response?

If you are using Active Directory do you have any URL rewrite rules setup for your environment? Could it be the case that the URLs above are not being handled correctly or are not included in your rules?

As you've seen the app will not work without 200 responses for these URLs, it's how the app now discovers what version the repo is and what URLs to subsequently use to communicate with the repository.

Hope that helps.

Re: authentication problems 2.0.2

mikeh — Mon, 20 Oct 2014 09:48:58 GMT

The XML file is a good start at least it means the CMIS API endpoint is addressable. If you load the XML file into any text editor, do the URLs match that of the request? For example, if your server is at alfresco.boston.org:8080/alfresco/cmisatom, do the absolute URLs inside the XML file match those exactly?

Thanks,
Mike

Re: authentication problems 2.0.2

gavinc — Mon, 20 Oct 2014 09:53:37 GMT

OK, that sounds correct.

The cmisatom.xml is the reponse to the CMIS discovery URL (/alfresco/cmisatom) it's essentially the entry point to the repository. It provides the URLs the app should use to retrieve folder and document information. The URLs this response returns should match your public facing URLs for your environment i.e. the one configured in the app. If there is a mismatch (normally due to incorrect rewrite rules or missing proxy configuration) the app will not be able to connect.

If this all looks correct then I'm not sure why you're having issues. Would you be able to provide access to your system so I can try with a debugger attached?

Re: authentication problems 2.0.2

boston — Mon, 20 Oct 2014 10:35:29 GMT

I found in .XML file the URLs which I use for connecting from mobile client. Looks like there's no mismatches. By the way, when connecting from mobile client, I use 1) proto - https 2) server - for example, alfresco.boston.org 3) - default "suffix" - /alfresco.
In cmisatom.xml I found https://alfresco.boston.org/alfresco/cmisatom. Maybe I should manually write cmisatom after /aflresco when set up mobile client?

Re: authentication problems 2.0.2

nishantqwerty — Mon, 20 Oct 2014 23:50:14 GMT

Apologies. I was trying the URL in the "Service DOcument" of the mobile client.
i.e. /alfresco/cmisatom

It gives me an authentication error.
Otherwise on the web browser I am getting a similar response as boston.

Re: authentication problems 2.0.2

gavinc — Wed, 22 Oct 2014 07:23:56 GMT

You shouldn't add the /cmisatom to the "service document" in the mobile client, this should be set to "/alfresco". The mobile app will determine the best URL to use according to the result of the /service/api/server (hence asking you both to check this URL is working).

If both these URLs are working for you and the contents of the CMIS discovery response is correct (URLs match) I'm not sure what is going wrong to be honest. We have a couple of options, either you capture the network traffic between the iPhone/iPad and your repository and post it here or if either of you could provide a test account to your system so that we can attach a debug version of the app and see what's going on. Feel free to send any auth details directly to me at gavin dot cornwell at alfresco dot com.

Re: authentication problems 2.0.2

gavinc — Wed, 22 Oct 2014 10:56:40 GMT

Boston has kindly given me access to their system so I was able to see what is happening.

The first URL is indeed working as expected, however the /alfresco/cmisatom URL is failing in a REST client, I receive a 500 error with the following exception in the HMTL response:


java.lang.NullPointerException
at org.alfresco.repo.webdav.auth.BaseNTLMAuthenticationFilter.processType3(BaseNTLMAuthenticationFilter.java:569)
at org.alfresco.repo.webdav.auth.BaseNTLMAuthenticationFilter.authenticateRequest(BaseNTLMAuthenticationFilter.java:297)
at org.alfresco.repo.webdav.auth.BaseSSOAuthenticationFilter.doFilter(BaseSSOAuthenticationFilter.java:135)
at sun.reflect.GeneratedMethodAccessor560.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
‍‍‍‍‍‍‍‍

I suspect when you guys tried this URL in your browser the NTLM process was handled by the browser which is why you saw it working. Unfortunately the app can not handle NTLM, it uses basic authentication and thus you are seeing the authentication error.

In 2.0.1, in this scenario, the app used to fallback to use the /service/cmis endpoint. This URL has been removed from 5.0 servers so v2.0.2 uses a different algorithm to determine which URL to use and no fallback takes place, this is why you're no longer able to connect.

In order for the app to work I presume your Alfresco admin has either excluded /alfresco/service URLs from being subject to NTLM or there is some other form of workaround to allow the app to communicate with your repository. This same configuration/workaround needs to be applied to allow alfresco/cmisatom URLs to be authenticated using basic auth.

Hope this helps you both.

Re: authentication problems 2.0.2

stephanep — Thu, 23 Oct 2014 10:03:35 GMT

Hi gavinc,

Thanks for this tips because we have the same problem than boston for Alfresco Entreprise 4.1.4. Is it enough to comment on the


<filter-mapping>
  <filter-name> Global Authentication Filter </ filter-name>
  <url-pattern> / cmisatom / * </ url-pattern>
</ filter-mapping>

<filter-mapping>
  <filter-name> Authentication Filter </ filter-name>
  <url-pattern> / cmisatom / * </ url-pattern>
</ filter-mapping>
‍‍‍‍‍‍‍‍‍‍‍

in web.xml or should we do something different file to fix this problem?

Thanks in advance.

Re: authentication problems 2.0.2

gavinc — Fri, 24 Oct 2014 12:41:51 GMT

No, you shouldn't change anything in web.xml, this will be a change outside of the core product. Your Alfresco administrator or IT department will most likely need to update any configuration they have put in place.

URLs of the form "hostort/alfresco/service/…" are working (presuming the 2.0.1 app was working ok for you) so whatever configuration was applied to allow those to work will need to be applied for "hostort/alfresco/cmisatom/…" URLs.

Hope that helps!

Re: authentication problems 2.0.2

nishantqwerty — Mon, 10 Nov 2014 02:59:50 GMT

Hi Gavin,
There were no configurations done for the "hostort/alfresco/service/…" to work with iOS app 2.0.1.
It worked as it is, out of the box.
Would it be a good idea to redirect the GET requests from "hostort/alfresco/cmisatom/…" to "hostort/alfresco/service/…" at the server side?
If yes, how can we do this?
Thank You,

Re: authentication problems 2.0.2

andrepra — Tue, 11 Nov 2014 10:23:14 GMT

I'm facing the same problem (authentication after saving the account setting) with version 2.0.2 on Alfresco Community 4.0.0. Using an old version of the app (1.5.3.90) everything works fine.
I tried the following url with a browser
http://<host>/alfresco/service/api/server
here the response


{
   "data":
   {
      "edition": "Community",
      "version": "4.0.0 (4003)",
      "schema": "5025"
   }
}
‍‍‍‍‍‍‍‍‍‍

and the following
http://<host>/alfresco/service/cmis
http://<host>/alfresco/cmisatom
after basic authentication returns the cmis xml (inside the file all the url have the correct host and port)

Installation is on port 80 (no SSL).
I have a similar installation using SSL protocol (443) that works fine.

Re: authentication problems 2.0.2

andrepra — Tue, 11 Nov 2014 14:11:00 GMT

Sorry, forget my post. It was a problem of the reverse proxy configuration.

Re: authentication problems 2.0.2

gavinc — Wed, 12 Nov 2014 08:41:59 GMT

Yes, in the last couple of days we have discovered a "known issue" with the server where the /cmisatom URL does not fallback to basic authentication when SSO is enabled. I believe this has been fixed for the next 4.2 service pack release.

In the meantime, yes, I think the best way forward for you is to redirect the …/cmisatom URLs to …/service/cmis, in fact this is exactly what another customer did to workaround this issue, see https://issues.alfresco.com/jira/browse/MOBILE-3084

How this is done will be dependent on your environment, typically it would be done with an Apache URL rewrite rule or something similar.

Re: authentication problems 2.0.2

102020 — Wed, 19 Nov 2014 18:59:44 GMT

Hey there,
we have same issue, running on 4.2.f community though. Using SSO and latest iOS app from the store. I'm about to test in the sandbox to exclude any customization we have done.

Re: authentication problems 2.0.2

nishantqwerty — Tue, 25 Nov 2014 03:25:00 GMT

Hi Gavin,
I have been trying to use Apache URL rewrite rule for redirecting the …/cmisatom URLs to …/service/cmis but all in vain.
Can you please send me a sample of the rewrite rule that can be used for this redirection?
I have tried the following :
–<VirtualHost *:80>
    ServerName <servername>
    AllowEncodedSlashes On



    RewriteEngine On
   # Redirect http://ip or url:8080/alfresco/cmisatom http://ip or url:8080/alfresco/service/cmis
   # Redirect http://ip or url/alfresco/cmisatom http://ip or url:8080/alfresco/service/cmis
   # Redirect /alfresco/cmisatom http://ip or url:8080/alfresco/service/cmis
     RewriteRule ^/alfresco/cmisatom$ http://ip or url:8080/alfresco/service/cmis [R]

    #proxy /alfresco and /share calls to the alfresco server
    ProxyPass /share ajp://localhost:8009/share
    ProxyPassReverse /share ajp://localhost:8009/share

    ProxyPass /alfresco ajp://localhost:8009/alfresco
    ProxyPassReverse /alfresco ajp://localhost:8009/alfresco

–</VirtualHost>