topic Alfresco CE 4.2e kerberos SSO in Alfresco Archive https://connect.hyland.com/t5/alfresco-archive/alfresco-ce-4-2e-kerberos-sso/m-p/308347#M261477 <HTML><HEAD></HEAD><BODY><SPAN>Hi all! </SPAN><STRONG>I'll be glad if you help me!</STRONG><BR /><BR /><SPAN>I need to setup SSO. I run alfresco on Ubuntu 12.04 srv x64</SPAN><BR /><BR /><SPAN>I use the how-to: </SPAN><A href="http://docs.alfresco.com/4.2/index.jsp?topic=%2Fcom.alfresco.enterprise.doc%2Ftasks%2Fauth-kerberos-ADconfig.html" rel="nofollow noopener noreferrer">http://docs.alfresco.com/4.2/index.jsp?topic=%2Fcom.alfresco.enterprise.doc%2Ftasks%2Fauth-kerberos-ADconfig.html</A><BR /><BR /><SPAN>So, I have like this:</SPAN><BR /><BR /><BR /><STRONG>/opt/alfresco-4.2.e/java/jre/lib/security/java.login.config</STRONG><BR /><BR /><PRE class="language-none line-numbers"><CODE>Alfresco {<BR />&nbsp;&nbsp; com.sun.security.auth.module.Krb5LoginModule sufficient;<BR />};<BR /><BR />AlfrescoCIFS {<BR />&nbsp;&nbsp; com.sun.security.auth.module.Krb5LoginModule required<BR />&nbsp;&nbsp; storeKey=true<BR />&nbsp;&nbsp; useKeyTab=true<BR />&nbsp;&nbsp; keyTab="/etc/cifsalfresco-dev.keytab"<BR />&nbsp;&nbsp; principal="cifs/alfresco-dev.tokk.domain";<BR />};<BR /><BR />AlfrescoHTTP<BR />{<BR />&nbsp;&nbsp; com.sun.security.auth.module.Krb5LoginModule required<BR />&nbsp;&nbsp; storeKey=true<BR />&nbsp;&nbsp; useKeyTab=true<BR />&nbsp;&nbsp; keyTab="/etc/httpalfresco-dev.keytab"<BR />&nbsp;&nbsp; principal="HTTP/alfresco-dev.tokk.domain";<BR />};<BR /><BR />ShareHTTP<BR />{<BR />&nbsp;&nbsp; com.sun.security.auth.module.Krb5LoginModule required<BR />&nbsp;&nbsp; storeKey=true<BR />&nbsp;&nbsp; useKeyTab=true<BR />&nbsp;&nbsp; keyTab="/etc/httpalfresco-dev.keytab"<BR />&nbsp;&nbsp; principal="HTTP/alfresco-dev.tokk.domain";<BR />};<BR /><BR />com.sun.net.ssl.client {<BR />&nbsp;&nbsp; com.sun.security.auth.module.Krb5LoginModule sufficient;<BR />};<BR /><BR />other {<BR />&nbsp;&nbsp; com.sun.security.auth.module.Krb5LoginModule sufficient;<BR />};<SPAN class="line-numbers-rows"><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN></SPAN></CODE></PRE><BR /><BR /><STRONG>/opt/alfresco-4.2.e/tomcat/webapps/alfresco/WEB-INF/classes/alfresco/subsystems/Authentication/kerberos/kerberos-authentication.properties</STRONG><BR /><BR /><PRE class="language-none line-numbers"><CODE>kerberos.authentication.sso.enabled=true<BR />kerberos.authentication.authenticateCIFS=true<BR /><BR />kerberos.authentication.realm=TOKK.DOMAIN<BR />kerberos.authentication.user.configEntryName=Alfresco<BR />kerberos.authentication.defaultAdministratorUserNames=administrator<BR /><BR />kerberos.authentication.cifs.configEntryName=AlfrescoCIFS<BR />kerberos.authentication.cifs.password=KAYshnz29<BR />kerberos.authentication.authenticateCIFS=true<BR /><BR />kerberos.authentication.http.configEntryName=AlfrescoHTTP<BR />kerberos.authentication.http.password=KAYshnz29<BR /><BR />kerberos.authentication.stripUsernameSuffix=true<SPAN class="line-numbers-rows"><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN></SPAN></CODE></PRE><BR /><BR /><STRONG>/opt/alfresco-4.2.e/tomcat/shared/classes/alfresco-global.properties</STRONG><BR /><BR /><PRE class="language-none line-numbers"><CODE><BR />###############################<BR />## Common Alfresco Properties #<BR />###############################<BR /><BR />dir.root=/opt/alfresco-4.2.e/alf_data<BR /><BR />alfresco.context=alfresco<BR />alfresco.host=127.0.0.1<BR />alfresco.port=8080<BR />alfresco.protocol=http<BR /><BR />share.context=share<BR />share.host=127.0.0.1<BR />share.port=8080<BR />share.protocol=http<BR /><BR />### database connection properties ###<BR />db.driver=org.postgresql.Driver<BR />db.username=alfresco<BR />db.password=vtuf,jcc<BR />db.name=alfresco<BR />db.url=jdbc:postgresql://localhost:5432/${db.name}<BR /><BR />### FTP Server Configuration ###<BR />ftp.enabled=true<BR />ftp.port=21<BR /><BR />### RMI service ports ###<BR />alfresco.rmi.services.port=50500<BR />avm.rmi.service.port=0<BR />avmsync.rmi.service.port=0<BR />attribute.rmi.service.port=0<BR />authentication.rmi.service.port=0<BR />repo.rmi.service.port=0<BR />action.rmi.service.port=0<BR />deployment.rmi.service.port=0<BR /><BR />### External executable locations ###<BR />ooo.exe=/opt/alfresco-4.2.e/libreoffice/program/soffice.bin<BR />ooo.enabled=true<BR />ooo.port=8100<BR />img.root=/opt/alfresco-4.2.e/common<BR />img.dyn=${img.root}/lib<BR />img.exe=${img.root}/bin/convert<BR />swf.exe=/opt/alfresco-4.2.e/common/bin/pdf2swf<BR />swf.languagedir=/opt/alfresco-4.2.e/common/japanese<BR /><BR />jodconverter.enabled=false<BR />jodconverter.officeHome=/opt/alfresco-4.2.e/libreoffice<BR />jodconverter.portNumbers=8100<BR /><BR />### Initial admin password ###<BR />alfresco_user_store.adminpassword=4b68d597112ce6490a339eeaf4051735<BR /><BR />### E-mail site invitation setting ###<BR />notification.email.siteinvite=false<BR /><BR />### License location ###<BR />dir.license.external=/opt/alfresco-4.2.e<BR /><BR />### Solr indexing ###<BR />index.subsystem.name=solr<BR />dir.keystore=${dir.root}/keystore<BR />solr.port.ssl=8443<BR /><BR />### BPM Engine ###<BR />system.workflow.engine.jbpm.enabled=false<BR /><BR />### CIFS settings ###<BR />cifs.enabled=true<BR />cifs.serverName=alfresco-dev<BR />cifs.domain=TOKK.DOMAIN<BR />cifs.hostannounce=true<BR />cifs.sessionTimeout=900<BR /><BR />### authentication ###<BR />kerberos1:kerberos<SPAN class="line-numbers-rows"><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN></SPAN></CODE></PRE><BR /><BR /><STRONG>cat /opt/alfresco-4.2.e/java/jre/lib/security/java.security |grep login.config.url</STRONG><BR /><PRE class="language-none line-numbers"><CODE>#login.config.url.1=file:${user.home}/.java.login.config<BR />login.config.url.1=file:${java.home}/lib/security/java.login.config<SPAN class="line-numbers-rows"><SPAN>‍</SPAN><SPAN>‍</SPAN></SPAN></CODE></PRE><BR /><BR /><SPAN>So, I have tested my keytab files, it looks like good!</SPAN><BR /><BR /><PRE class="language-none line-numbers"><CODE><BR />root@alfresco-dev:~# kinit -V -k -t /etc/httpalfresco-dev.keytab HTTP/alfresco-dev.tokk.domain<BR />Using default cache: /tmp/krb5cc_0<BR />Using principal: HTTP/alfresco-dev.tokk.domain@TOKK.DOMAIN<BR />Using keytab: /etc/httpalfresco-dev.keytab<BR />Authenticated to Kerberos v5<BR />root@alfresco-dev:~# klist<BR />Ticket cache: FILE:/tmp/krb5cc_0<BR />Default principal: HTTP/alfresco-dev.tokk.domain@TOKK.DOMAIN<BR /><BR />Valid starting&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Expires&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Service principal<BR />06.03.2014 16:36:47&nbsp; 07.03.2014 02:36:47&nbsp; krbtgt/TOKK.DOMAIN@TOKK.DOMAIN<BR />&nbsp;&nbsp; renew until 07.03.2014 16:36:47 <SPAN class="line-numbers-rows"><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN></SPAN></CODE></PRE><BR /><BR /><SPAN>I have setup my Internet Explorer as shown in how-to. My Windows is in a domain, and I have a TGT. When I start my IE I see just login page on the address: </SPAN><A href="http://alfresco-dev.tokk.domain:8080/share/page/" rel="nofollow noopener noreferrer">http://alfresco-dev.tokk.domain:8080/share/page/</A><SPAN>&nbsp; I can login via local admin by use it's password… It is very strange… I have setup: kerberos1:kerberos only. </SPAN><BR /><BR /><SPAN>Please tell me, how-to debug my configuration. I want to know about path my config files. Is it correct? Please help me with it. </SPAN><BR /><BR /><SPAN>It's a fresh setup alfresco, so I don't have any ldap settings and other settings. May be I need it before kerberos? I want to test SSO only for auth only, after that I'll be setup ldap-ad sync for group and permissions control of my user.</SPAN><BR /><BR /></BODY></HTML> Fri, 07 Mar 2014 06:05:20 GMT vgusev2007 2014-03-07T06:05:20Z Alfresco CE 4.2e kerberos SSO https://connect.hyland.com/t5/alfresco-archive/alfresco-ce-4-2e-kerberos-sso/m-p/308347#M261477 Hi all! I'll be glad if you help me!I need to setup SSO. I run alfresco on Ubuntu 12.04 srv x64I use the how-to: http://docs.alfresco.com/4.2/index.jsp?topic=%2Fcom.alfresco.enterprise.doc%2Ftasks%2Fauth-kerberos-ADconfig.htmlSo, I have like this:/opt/alfresco-4.2.e/java/jre/lib/security/java.login. Fri, 07 Mar 2014 06:05:20 GMT https://connect.hyland.com/t5/alfresco-archive/alfresco-ce-4-2e-kerberos-sso/m-p/308347#M261477 vgusev2007 2014-03-07T06:05:20Z Re: Alfresco CE 4.2e kerberos SSO https://connect.hyland.com/t5/alfresco-archive/alfresco-ce-4-2e-kerberos-sso/m-p/308348#M261478 <HTML><HEAD></HEAD><BODY><SPAN>Your authentication chain in alfresco- global.properties is missing the left hand side.</SPAN></BODY></HTML> Fri, 07 Mar 2014 08:32:46 GMT https://connect.hyland.com/t5/alfresco-archive/alfresco-ce-4-2e-kerberos-sso/m-p/308348#M261478 mrogers 2014-03-07T08:32:46Z Re: Alfresco CE 4.2e kerberos SSO https://connect.hyland.com/t5/alfresco-archive/alfresco-ce-4-2e-kerberos-sso/m-p/308349#M261479 <HTML><HEAD></HEAD><BODY><SPAN>Hi! Really big thank to you for you help! I fixed the mistake!</SPAN><BR /><BR /><BR /><SPAN>After fix the problem I can't login as as local admin - It's normal. When I start IE, I seen a logon page (share). After insert a login and password from my domain for example: administrator pass - I can entry to alfresco share!</SPAN><BR /><BR /><SPAN>So, I have two question:</SPAN><BR /><BR /><SPAN>The first: Why can I login to alfresco share with a login and password from a domain? I have ONLY kerberos auth… I didn't have any ldap setup…</SPAN><BR /><BR /><PRE class="language-none line-numbers"><CODE>authentication.chain=kerberos1:kerberos<SPAN class="line-numbers-rows"><SPAN>‍</SPAN></SPAN></CODE></PRE><BR /><BR /><BR /><SPAN>Many thank for you! I don't have an expirience with Java, I'm sysadmin only.</SPAN><BR /><BR /><STRONG>P.S. <A href="http://alfresco-dev.tokk.domain:8080/alfresco" rel="nofollow noopener noreferrer">http://alfresco-dev.tokk.domain:8080/alfresco</A> has SSO!</STRONG><SPAN> <img id="smileyhappy" class="emoticon emoticon-smileyhappy" src="https://connect.hyland.com/i/smilies/16x16_smiley-happy.png" alt="Smiley Happy" title="Smiley Happy" /></SPAN><BR /><BR /><BR /><BR /><BR /></BODY></HTML> Fri, 07 Mar 2014 10:42:00 GMT https://connect.hyland.com/t5/alfresco-archive/alfresco-ce-4-2e-kerberos-sso/m-p/308349#M261479 vgusev2007 2014-03-07T10:42:00Z Re: Alfresco CE 4.2e kerberos SSO https://connect.hyland.com/t5/alfresco-archive/alfresco-ce-4-2e-kerberos-sso/m-p/308350#M261480 <HTML><HEAD></HEAD><BODY><SPAN>I'm sorry, I think I need to setup this one: </SPAN><A href="http://docs.alfresco.com/4.2/topic/com.alfresco.enterprise.doc/tasks/auth-kerberos-shareSSO.html" rel="nofollow noopener noreferrer">http://docs.alfresco.com/4.2/topic/com.alfresco.enterprise.doc/tasks/auth-kerberos-shareSSO.html</A><SPAN> </SPAN><BR /><BR /><BR /><SPAN>Thank! I'll post my result!</SPAN></BODY></HTML> Fri, 07 Mar 2014 11:00:00 GMT https://connect.hyland.com/t5/alfresco-archive/alfresco-ce-4-2e-kerberos-sso/m-p/308350#M261480 vgusev2007 2014-03-07T11:00:00Z