topic Re: NTLM works great... except with webclient in Alfresco Archive

NTLM works great... except with webclient

adrian — Mon, 16 Jul 2007 13:36:17 GMT

Hi,I have configured Alfresco to use NTLM authentication. It works fine with CIFS or WebDAV : I can browse my files without being asked for a login/password. But I got an error when trying to use web-browser.When I type http://localhost:8080/alfresco/ I'm not asked anymore for a login/password (as e

Re: NTLM works great... except with webclient

jpfi — Thu, 26 Jul 2007 06:50:11 GMT

Hi,

I 've the same problem. But I figured out, that if I configure the alfresco URL only to be in the internet zone of IE, I get an the browser authentication window (not the alfresco login page). Entering there the domain login data works fine.
I don've any explanation why the direct hidden authentication via browser causes th passthru exception and a manual input via browser authentication window works.
Any idea?
Thanks, jpfi

Re: NTLM works great... except with webclient

adrian — Thu, 26 Jul 2007 08:18:58 GMT

Hi jpfi

So I'm not the only one. :wink: I don't know why it's happening. From CIFS, if I use the drag'n'drop on one of the 3 Alfresco icons, Firefox asks for a login/password with its own authentication window (not with Alfresco login page, like you).
I looked into the source code of NTLMAuthenticationComponentImpl.java , the error happens in the bold line :

[ … ]
if ( authSess == null)
{
            // Check if the token has a challenge, if it does then the associated session has been
            // timed out

            if ( ntlmToken.getChallenge() != null)
                throw new CredentialsExpiredException("Authentication session expired");

            // Open an authentication session for the new token and add to the active session list

            authSess = m_passthruServers.openSession( false, ntlmToken.getClientDomain());

            // Check if the session was opened to the passthru server

            if ( authSess == null)
               throw new AuthenticationServiceException("Failed to open passthru auth session");

            ntlmToken.setAuthenticationExpireTime(System.currentTimeMillis() + getSessionTimeout());

            // Get the challenge from the initial session negotiate stage

            ntlmToken.setChallenge(new NTLMChallenge(authSess.getEncryptionKey()));
[ … ]

I found this : http://issues.alfresco.com/browse/AR-1555
The problem is similar, but I don't know if it's the same.
Anyway I didn't get NTLM passthru working with web-client, so I put back
the default filter (org.alfresco.web.app.servlet.AuthenticationFilter) for web-client in web.xml. Users have to log manually, but at least there's not an error message.

Re: NTLM works great... except with webclient

andy — Thu, 26 Jul 2007 08:30:23 GMT

Hi

In your config file, prefix your entry with the domain for the server.


        <property name="servers">
           <value>DOMAIN\192.168.1.1</value>
        </property>

‍‍‍‍‍‍

Andy

Re: NTLM works great... except with webclient

andy — Thu, 26 Jul 2007 08:31:13 GMT

Hi

… this is for the NTLM authentication component config.

Andy

Re: NTLM works great... except with webclient

adrian — Thu, 09 Aug 2007 14:36:01 GMT

Hi

Thank you for answering

I already tried this, but it didn't work.
I did a new install but this time with the 2.1 final on a Red Hat server, and the problem is still there. (and CIFS, webDAV work well with SSO)

Anyway it's not really a problem for us : we want to use the classic web-client filter so external people can log in from the Internet.

Re: NTLM works great... except with webclient

andy — Mon, 03 Sep 2007 14:47:30 GMT

Hi

There is something going on related to network connections and urls. I have various nets connections - using different urls to access alfresco some work and some not.

If localhost fails - try the hostname or ip address.

I have raise the issue.

Cheers

Andy