topic Re: NTLM and CIFS configuration in Alfresco Archive

NTLM and CIFS configuration

stastsarevsky — Fri, 27 Jul 2007 11:03:14 GMT

Hi,i'm fully confused with configuring ntlm authentication and CIFS. Version of Alfresco is 2.1 Community Edition on Windows 2003 server/Tomcat. So far I tried 2 ways:1) Configuring NTLM for webaccess. As described in "Configuring NTLM" in Wiki. Work perfectly fine. I was able access http://serverna

Re: NTLM and CIFS configuration

stastsarevsky — Mon, 30 Jul 2007 12:52:49 GMT

Still was not able to configure any access via CIFS using either patthru or Kerberos authentication. Here is my configuration files:

java.login.config


Alfresco {
com.sun.security.auth.module.Krb5LoginModule sufficient;
};

com.sun.net.ssl.client {
com.sun.security.auth.module.Krb5LoginModule sufficient;
};

other {
com.sun.security.auth.module.Krb5LoginModule sufficient;
};
‍‍‍‍‍‍‍‍‍‍‍‍‍

java.security


login.config.url.1=file:${java.home}/lib/security/java.login.config
‍‍‍

C:\WINNT\kb5.ini


[libdefaults]
 default_realm = TEST

[realms]
 TEST = {
  kdc = w2k3dc1.test.virtec
  admin_server = w2k3dc1.test.virtec
 }


[domain_realm]
 w2k3dc1.test.virtec = TEST
 .w2k3dc1.test.virtec = TEST
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

file-servers.xml


<alfresco-config area="file-servers">

   <config evaluator="string-compare" condition="CIFS Server">
     <serverEnable enabled="true"/>
      <host name="W3KSERVER_A" domain="TEST"/>
      <comment>Alfresco CIFS Server</comment>

      <!– Set to the broadcast mask for the subnet –>
      <broadcast>255.255.255.255</broadcast>

      <!– Use Java socket based NetBIOS over TCP/IP and native SMB on linux –>
      <tcpipSMB platforms="linux,solaris,macosx"/>
      <netBIOSSMB platforms="linux,solaris,macosx"/>

       
      <hostAnnounce interval="5"/>

      <!– Use Win32 NetBIOS interface on Windows –>
      <Win32NetBIOS/>
      <Win32Announce interval="5"/>

      <sessionDebug flags="Negotiate,Socket,Tree,Errors,State"/>
   </config>

   <config evaluator="string-compare" condition="FTP Server">
     <serverEnable enabled="true"/>

   </config>
   
   <config evaluator="string-compare" condition="NFS Server">
     <serverEnable enabled="false"/>
   </config>
   
   <config evaluator="string-compare" condition="Filesystems">
     <filesystems>
     
       <!– Alfresco repository access shared filesystem –>
         <filesystem name="Alfresco">
            <store>workspace://SpacesStore</store>
            <rootPath>/app:company_home</rootPath>

         <!– Add a URL file to each folder that links back to the web client –>
         <urlFile>
               <filename>__AlfrescoClient.url</filename>
               <webpath>http://${localname}:8080/alfresco/</webpath>
            </urlFile>

         <!– Mark locked files as offline –> 
          <offlineFiles/>

         <!– Desktop actions –>
         <!– Uses a client-side application to trigger a server-side action                         –>
         <!–   Echo - displays a message echoed from the server                                     –>
         <!–   URL  - launches a URL via the Windows shell                                          –>
         <!–   CmdLine - launches the Notepad application                                           –>
         <!–   CheckInOut - checks files in/out, drag and drop files onto the application           –>
         <!–   JavaScript - run a server-side script                                                –>
         <!–   JavaScriptURL - server-side script that generates a URL to the folder using a ticket –>
         <!–                   to avoid having to logon                                             –>

<!–
         <desktopActions>
            <global>
                    <path>alfresco/desktop/Alfresco.exe</path>
               <webpath>http://${localname}:8080/alfresco/</webpath>
            </global>
            <action>
               <class>org.alfresco.filesys.smb.server.repo.desk.EchoDesktopAction</class>
               <name>Echo</name>
                 <filename>__AlfrescoEcho.exe</filename>
            </action>
            <action>
               <class>org.alfresco.filesys.smb.server.repo.desk.URLDesktopAction</class>
               <name>URL</name>
                 <filename>__AlfrescoURL.exe</filename>
            </action>
            <action>
               <class>org.alfresco.filesys.smb.server.repo.desk.CmdLineDesktopAction</class>
               <name>CmdLine</name>
                 <filename>__AlfrescoCmd.exe</filename>
            </action>
            <action>
               <class>org.alfresco.filesys.smb.server.repo.desk.CheckInOutDesktopAction</class>
               <name>CheckInOut</name>
                 <filename>__AlfrescoCheckInOut.exe</filename>
            </action>
            <action>
               <class>org.alfresco.filesys.smb.server.repo.desk.JavaScriptDesktopAction</class>
               <name>JavaScript</name>
               <filename>__AlfrescoScript.exe</filename>
               <script>alfresco/desktop/dumpRequest.js</script>
               <attributes>anyFiles, multiplePaths , allowNoParams</attributes>
               <preprocess>confirm, copyToTarget</preprocess>
            </action>
            <action>
               <class>org.alfresco.filesys.smb.server.repo.desk.JavaScriptDesktopAction</class>
               <name>JavaScriptURL</name>
               <filename>__AlfrescoDetails.exe</filename>
               <script>alfresco/desktop/showDetails.js</script>
               <attributes>anyFiles</attributes>
               <preprocess>copyToTarget</preprocess>
            </action>

         </desktopActions>
–>          
                    
<!–
            <accessControl default="Write">
               <user name="admin" access="Write"/>
               <address subnet="90.1.0.0" mask="255.255.0.0" access="Write"/>
            </accessControl>
–>
         </filesystem>
        
       <!– AVM virtualization view of all stores/versions for WCM –>
         <avmfilesystem name="AVM">
            <virtualView/>
         </avmfilesystem>
        
      </filesystems>
   </config>


<config evaluator="string-compare" condition="Filesystem Security">
<authenticator type="passthru">
<LocalDomain/>
</authenticator>
 </config>


</alfresco-config>

‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

jaas-authentication-context.xml


<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE beans PUBLIC '-//SPRING//DTD BEAN//EN' 'http://www.springframework.org/dtd/spring-beans.dtd'>

<beans>
    <!– The authentication component.                                      –>

    <!– Jass authentication - most of the config goes somewhere else       –>
       
    <bean id="authenticationComponent" 
                 class="org.alfresco.repo.security.authentication.jaas.JAASAuthenticationComponent">
        <property name="realm">
            <value>TEST</value>
        </property>
        <property name="jaasConfigEntryName">
            <value>Alfresco</value>
        </property>
    </bean>

      <bean id="alfDaoImpl" class="org.springframework.transaction.interceptor.TransactionProxyFactoryBean">
           <property name="proxyInterfaces">
                  <value>
                      org.alfresco.repo.security.authentication.MutableAuthenticationDao
                  </value>
           </property>
           <property name="transactionManager">
                  <ref bean="transactionManager" />
           </property>
           <property name="target">
                  <bean class="org.alfresco.repo.security.authentication.ntlm.NullMutableAuthenticationDao" />
           </property>
           <property name="transactionAttributes">
                <props>
                     <prop key="*">${server.transaction.mode.default}</prop>
                </props>
           </property>
       </bean>

</beans>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

alfresco.log


14:40:09,533 DEBUG [org.alfresco.smb.protocol.auth] Passthru finding domain controller for TEST …
14:40:09,877 DEBUG [org.alfresco.smb.protocol.auth]   Found 1 domain controller(s)
14:40:09,877 DEBUG [org.alfresco.smb.protocol.auth] Added passthru server [TEST\W2K3DC1:192.168.0.235:Offline:0,0]
14:40:09,986 DEBUG [org.alfresco.smb.protocol.auth] New auth session from w3kserver_1 to \\192.168.0.235\IPC$\
14:40:09,986 DEBUG [org.alfresco.smb.protocol.auth] Trying address 192.168.0.235
14:40:09,986 DEBUG [org.alfresco.smb.protocol.auth] Connected to address 192.168.0.235
14:40:09,986 DEBUG [org.alfresco.smb.protocol.auth] Connected session, protocol : TCP/IP NetBIOS
14:40:09,986 DEBUG [org.alfresco.smb.protocol.auth] SessionFactory: Negotiated SMB dialect NT LM 0.12
14:40:10,002 DEBUG [org.alfresco.smb.protocol.auth] Passthru server online, [TEST\W2K3DC1:192.168.0.235:Online:0,0]
14:40:15,205 WARN  [org.springframework.remoting.rmi.RmiRegistryFactoryBean] Could not detect RMI registry - creating new one
14:40:26,846 INFO  [org.alfresco.repo.domain.schema.SchemaBootstrap] No changes were made to the schema.
14:40:29,252 INFO  [org.alfresco.repo.admin.ConfigurationChecker] The Alfresco root data directory ('dir.root') is: C:\Alfresco\alf_data
14:40:29,533 INFO  [org.alfresco.repo.admin.patch.PatchExecuter] Checking for patches to apply …
14:40:29,643 INFO  [org.alfresco.repo.module.ModuleServiceImpl] Found 0 module(s).
14:40:29,830 DEBUG [org.alfresco.smb.protocol] Added desktop action CheckInOut
14:40:29,830 DEBUG [org.alfresco.smb.protocol] Added desktop action JavaScriptURL
14:40:29,986 DEBUG [org.alfresco.smb.protocol] Local domain name is TEST (via JNI)
14:40:29,986 DEBUG [org.alfresco.smb.protocol.auth] Passthru finding domain controller for TEST …
14:40:30,002 DEBUG [org.alfresco.smb.protocol.auth]   Found 1 domain controller(s)
14:40:30,002 DEBUG [org.alfresco.smb.protocol.auth] Added passthru server [TEST\W2K3DC1:192.168.0.235:Offline:0,0]
14:40:30,002 INFO  [org.alfresco.smb.protocol] CIFS server started
14:40:30,002 DEBUG [org.alfresco.smb.protocol.auth] New auth session from w3kserver_2 to \\192.168.0.235\IPC$\
14:40:30,002 INFO  [org.alfresco.smb.protocol] FTP server started
14:40:30,002 DEBUG [org.alfresco.smb.protocol.auth] Trying address 192.168.0.235
14:40:30,002 INFO  [org.alfresco.smb.protocol] NFS server NOT started
14:40:30,002 DEBUG [org.alfresco.smb.protocol.auth] Connected to address 192.168.0.235
14:40:30,002 DEBUG [org.alfresco.smb.protocol.auth] Connected session, protocol : TCP/IP NetBIOS
14:40:30,002 DEBUG [org.alfresco.smb.protocol.auth] SessionFactory: Negotiated SMB dialect NT LM 0.12
14:40:30,002 DEBUG [org.alfresco.smb.protocol.auth] Passthru server online, [TEST\W2K3DC1:192.168.0.235:Online:0,0]
14:40:30,018 INFO  [org.alfresco.service.descriptor.DescriptorService] Alfresco JVM - v1.5.0_08-b03; maximum heap size 506,313MB
14:40:30,018 INFO  [org.alfresco.service.descriptor.DescriptorService] Alfresco started (Community Network): Current version 2.1.0 (R1 443) schema 62 - Installed version 2.1.0 (R1 443) schema 62
14:40:30,111 INFO  [org.alfresco.smb.protocol] SMB Server W3KSERVER_A starting
14:40:30,111 INFO  [org.alfresco.smb.protocol] GUID 8f6645ae-1766-3622-bdfc-420fe6990391
14:40:30,111 INFO  [org.alfresco.smb.protocol] Using authenticator org.alfresco.filesys.server.auth.passthru.PassthruAuthenticator
14:40:30,111 INFO  [org.alfresco.smb.protocol] Server timezone Europe/Berlin, offset from UTC = -1hrs
14:40:30,111 INFO  [org.alfresco.smb.protocol] Shares:
14:40:30,127 INFO  [org.alfresco.smb.protocol]  [Alfresco,DISK,,[Alfresco,workspace://SpacesStore/bb81fb57-3a73-11dc-bc20-21e3719ab596]] [Alfresco,workspace://SpacesStore/bb81fb57-3a73-11dc-bc20-21e3719ab596]
14:40:30,127 INFO  [org.alfresco.smb.protocol]  [AVM,DISK,,[AVM,VirtualView]] [AVM,VirtualView]
14:40:30,127 INFO  [org.alfresco.smb.protocol] Add Share [IPC$,IPC$,,Admin,Hidden] : true
14:40:30,596 DEBUG [org.alfresco.smb.protocol] Win32 NetBIOS Available LANAs: 0 
14:40:30,611 DEBUG [org.alfresco.smb.protocol] Win32 NetBIOS server W3KSERVER_A (using Winsock)
14:40:36,658 DEBUG [org.alfresco.smb.protocol] Win32 NetBIOS created session handler on LANA 0
14:40:36,674 DEBUG [org.alfresco.smb.protocol] Win32 NetBIOS host announcer enabled on LANA 0
14:40:36,674 DEBUG [org.alfresco.smb.protocol] Waiting for Win32 NetBIOS session request (Winsock) …
14:40:36,690 DEBUG [org.alfresco.smb.protocol.mailslot] HostAnnouncer: Announced host W3KSERVER_A
14:40:36,690 DEBUG [org.alfresco.smb.protocol] Win32 NetBIOS register listener for LANA 0
14:40:41,690 DEBUG [org.alfresco.smb.protocol.mailslot] HostAnnouncer: Announced host W3KSERVER_A
14:40:51,690 DEBUG [org.alfresco.smb.protocol.mailslot] HostAnnouncer: Announced host W3KSERVER_A
14:41:11,690 DEBUG [org.alfresco.smb.protocol.mailslot] HostAnnouncer: Announced host W3KSERVER_A
14:41:51,690 DEBUG [org.alfresco.smb.protocol.mailslot] HostAnnouncer: Announced host W3KSERVER_A
14:43:11,705 DEBUG [org.alfresco.smb.protocol.mailslot] HostAnnouncer: Announced host W3KSERVER_A
14:45:51,705 DEBUG [org.alfresco.smb.protocol.mailslot] HostAnnouncer: Announced host W3KSERVER_A

‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Re: NTLM and CIFS configuration

savs — Tue, 31 Jul 2007 13:30:56 GMT

Can anyone at Alfresco comment on this? We've also got NTLM authentication working, but cannot make CIFS work in conjunction with it. (We're not using LDAP or JAAS, as we're not sure that they are also required.)

When using enterprise authenticator we get:

14:18:41,829 ERROR [smb.protocol.auth] No valid CIFS authentication combination available
14:18:41,829 ERROR [smb.protocol.auth] Either enable Kerberos support or use an authentication component that supports MD4 hashed passwords
14:18:41,833 ERROR [alfresco.smb.protocol] CIFS server configuration error, Invalid CIFS authenticator configuration
org.alfresco.error.AlfrescoRuntimeException: Invalid CIFS authenticator configuration
        at org.alfresco.filesys.server.auth.EnterpriseCifsAuthenticator.initialize(EnterpriseCifsAuthenticator.java:348)‍‍‍‍‍

When using passthru authenticator we see no errors, but on trying to connect with e.g. smbclient we see:


smbclient -d10 -U foo \\\\10.1.100.100\\alfresco
… snip …
server didn't supply a full spnego negprot
… snip …
SPNEGO login failed: Unexpected information received
session setup failed: NT_STATUS_INVALID_PARAMETER‍‍‍‍‍‍‍

We've reviewed http://forums.alfresco.com/viewtopic.php?t=5169 and http://forums.alfresco.com/viewtopic.php?t=3777 and http://forums.alfresco.com/viewtopic.php?t=6887 and http://wiki.alfresco.com/wiki/CIFS_linux and http://wiki.alfresco.com/wiki/CIFS and http://wiki.alfresco.com/wiki/CIFS_Server_Authentication, but apart from providing conflicting advice, none of those resources help.

So - what's the definitive way of configuring CIFS and NTLM together?

Re: NTLM and CIFS configuration

mindthegab — Tue, 31 Jul 2007 13:45:59 GMT

With respect to the previous post (we're working together) after raising a little bit the log level we get some more info when using enterprise authentication:

14:37:20,370 DEBUG [smb.protocol.auth] Added passthru server [myname.server.org:10.1.1.33:Offline:0,0]
14:37:20,399 DEBUG [smb.protocol.auth] New auth session from alfresco-test_1 to \\10.1.1.33\IPC$\
14:37:20,422 DEBUG [smb.protocol.auth] Trying address 10.1.1.33
14:37:20,425 DEBUG [smb.protocol.auth] Connected to address 10.1.1.33
14:37:20,426 DEBUG [smb.protocol.auth] Connected session, protocol : TCP/IP NetBIOS
14:37:20,438 DEBUG [smb.protocol.auth] SessionFactory: Negotiated SMB dialect NT LM 0.12
14:37:20,445 DEBUG [smb.protocol.auth] Passthru server online, [myname.server.org:10.1.1.33:Online:0,0]
‍‍‍‍‍‍‍‍

After this (quite positive) message we still get the error mentioned by savs.

Help lovely appreciated

Re: NTLM and CIFS configuration

savs — Tue, 31 Jul 2007 13:53:34 GMT

It seems that CIFS only works with NTLM authentication when you use the 'alfresco' authenticator. See http://wiki.alfresco.com/wiki/Enterprise_Security_and_Authentication_Configuration#Which_authentication_components_are_compatible_with_which_web_authentication_filters_and_filesystem_security.3F for details

Re: NTLM and CIFS configuration

mikef — Tue, 31 Jul 2007 16:03:26 GMT

Just to confirm. You have sso working via IE and not CIFS, correct?

What is your authenticator type set to in file-servers?

Re: NTLM and CIFS configuration

savs — Wed, 01 Aug 2007 08:26:43 GMT

Just to confirm. You have sso working via IE and not CIFS, correct?

That's correct. We can connect to the alfresco network share using smbclient, but Windows / Mac native clients fail to connect.

What is your authenticator type set to in file-servers?

It's set to 'alfresco'.

<config evaluator="string-compare" condition="Filesystem Security">
  <authenticator type="alfresco"/>
</config>
‍‍‍‍

We've tried passthru, enterprise etc. but they don't seem to work.

Re: NTLM and CIFS configuration

mindthegab — Wed, 01 Aug 2007 09:32:35 GMT

Just FYI,
we got it working (both IE and CIFS) after having checked AD user permissions.
So now we're able to have NTLM SSO in both environments, which is cool indeed 😉

Gab

PS.
It still fails on macosx, but well, it's not our first priority..

Re: NTLM and CIFS configuration

mikef — Wed, 01 Aug 2007 09:38:41 GMT

Good to hear you got it working.

It would be useful for other readers to provide some details on the '..checked AD user permissions'

Re: NTLM and CIFS configuration

stastsarevsky — Wed, 01 Aug 2007 10:24:04 GMT

Just FYI,
we got it working (both IE and CIFS) after having checked AD user permissions.
So now we're able to have NTLM SSO in both environments, which is cool indeed 😉

Gab

Could you describe step-by-step what exactly was done on Alfresco machine to make CIFS using NTLM SSO? Also is it running on linux or on Windows?

What changes done in:
1) file-servers.xml
2) ntlm-authentication-context.xml
3) kb5.ini if it's created
4) java.login.config if it's created
5) jaas-authentication-context.xml if it's created

Also what AD user permissions were set for users and is any special done on domain server (like creating alfrescocifs user, registering service principals and so on).

Re: NTLM and CIFS configuration

sessa — Wed, 01 Aug 2007 10:49:04 GMT

Hi !

I'm also working on SSO with Alfresco.
If I log me in in IE I don't need to log me in again in CIFS. But if I close IF and start it again, I'm again asked for password.
If SSO would work properly I wouldn't been asked, right ?

how do i have to configure

- file-servers.xml
- ntlm-authentication-context.xml

can someone please post an example ?

thanks,

Re: NTLM and CIFS configuration

andy — Thu, 09 Aug 2007 16:03:56 GMT

Hi

You need to define the correct filters in web.xml for NTLM SSO for the UI and webDAV.

Andy

Re: NTLM and CIFS configuration

sessa — Tue, 14 Aug 2007 11:20:45 GMT

I don't want NTLM SSO.

I read that there is also a way with JAAS / Kerberos.

What can you suggest ?

Thanks

Re: NTLM and CIFS configuration

mindthegab — Wed, 29 Aug 2007 09:20:24 GMT

As soon as I have a second (superbusy these after-holiday days),
I'll gather our configuration files and post them here.

BTW, for "checked AD user permissions" I just meant:

Tested with a proper user (with working credentials on that domain), instead with the on-the-fly created user (which was missing permissions on that domain).

Stay tuned then!

Re: NTLM and CIFS configuration

andy — Fri, 07 Sep 2007 15:48:11 GMT

Hi

Kerberos SSO support for the web client and WebDAV is work in progress. At the moment there is NTLMv1 SSO or integration with the likes of Siteminder for SSO. There are also instructions on the forums describing how to get CAS up and working for SSO.

Andy

Re: NTLM and CIFS configuration

mindthegab — Wed, 19 Sep 2007 10:17:40 GMT

Hi all,
here follows the configuration which we successfully implemented in our company Sourcesense ([3]) and which basically provides LDAP integration and NTLM single sign-on for connecting to Alfresco through web browsers and through Windows File Sharing. Sorry for the long delay but had quite busy days with this Alfresco thing. It's cool and is definitely being increasingly accepted and used in wider and wider enterprises.

Here it goes, hopefully can help to solve and gather the whole number of unstructured forum posts talking about the subject. Sorry for the long post but I preferred to made the *whole* conf files available.

SYSTEM SPECS:

ALFRESCO SERVER:
- Alfresco 2.1 Comm
- Mysql
- Tomcat 5.5.20
- Ubuntu Linux1 7.04

CLIENTS:
- Linux + FF2
- WinXP + IE6
- OSX10.4 + FF2

REQUIREMENTS:
- Integration with Microsoft Active Directory (NTLM + webclient/CIFS + LDAP )

NOTES:
- We started from the default alfresco bundle (linux installer)
- I removed default comments from this file in order to improve readability (seems a paradox, but who will read this post will already know the basic stuff written in those comments…i guess. ;-). I added some configuration specific comments thay may be useful to understand what's going on
- Sensitive data has been removed so don't smile at my funny domain fake names
- Even if I integrated with AD, well, openLDAP would have rocked better 🙂 (i hate bill, typical…)
- Thx to savs for coaching support and for providing useful docs !

NAMING CONVENTIONS:
ALF_HOME = base installation folder of the Alfresco instance
ALF_CLASSES = $ALF_HOME/tomcat/WEB-INF/classes/alfresco
ALF_SHARED_CLASSES = $ALF_HOME/tomcat/shared/classes/alfresco/extension

STEPS:

A. Enable NTLM passtrough for SSO purposes:

- Edit the provided
- Change the $ALF_HOME/tomcat/WEB-INF/web.xml to enable the NTLMAuthentication servlet filter. So comment out the default filter and uncomment it as follows (both for webclient and webdav, in case of need):

<filter>
  <filter-name>Authentication Filter</filter-name>
  <!–
    <filter-class>org.alfresco.web.app.servlet.AuthenticationFilter</filter-class>
  –>
  <!– For Novell IChain support use the following filter –>
  <!–
    <filter-class>org.alfresco.web.app.servlet.NovellIChainsHTTPRequestAuthenticationFilter</filter-class>
  –>

  <!– For NTLM authentication support use the following filter –>
  <filter-class>org.alfresco.web.app.servlet.NTLMAuthenticationFilter</filter-class>
</filter>

<filter>
  <filter-name>WebDAV Authentication Filter</filter-name>
  <!–
    <filter-class>org.alfresco.repo.webdav.auth.AuthenticationFilter</filter-class>
  –>
  <!– For NTLM authentication support use the following filter –>
  <filter-class>org.alfresco.repo.webdav.auth.NTLMAuthenticationFilter</filter-class>
</filter>

<filter>
  <filter-name>Admin Authentication Filter</filter-name>
  <filter-class>org.alfresco.web.app.servlet.AdminAuthenticationFilter</filter-class>
</filter>‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

- change the $ALF_SHARED_CLASSES/ntlm-authentication-context.xml.sample to $ALF_SHARED_CLASSES/ntlm-authentication-context.xml
- Edit the file so that it looks as follows:


   <?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE beans PUBLIC '-//SPRING//DTD BEAN//EN' 'http://www.springframework.org/dtd/spring-beans.dtd'>
<beans>
  <bean id="authenticationDao" class="org.alfresco.repo.security.authentication.ntlm.NullMutableAuthenticationDao" />
  <bean id="authenticationComponent" class="org.alfresco.repo.security.authentication.ntlm.NTLMAuthenticationComponentImpl">
    <property name="personService">
      <ref bean="personService" />
    </property>
    <property name="nodeService">
      <ref bean="nodeService" />
    </property>
    <property name="transactionService">
      <ref bean="transactionComponent" />
    </property>
    <property name="guestAccess">
      <value>false</value>
    </property>
    <!– Name of the windows domain \ domain controller hostname or ip –>
    <property name="servers">
      <value>WINDOWSDOMAIN\domainControllerIPorHostname</value>
    </property>
  </bean>
</beans>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

- Restart alfresco and this should have already enabled NTLM SSO against your Domain Controller
NOTE:
- Both Internet Explorer and Firefox support NTLM authentication, though Firefox will prompt the user for a username and password on the first connection attempt (subsequently username and password can be stored by Firefox). Internet Explorer will pass the Windows authentication details directly to the Alfresco server. Note that single sign-on with Internet Explorer will only work if the Alfresco server is perceived to be within the local intranet zone (for example if the server has a name in the local DNS). This can also be forced within Internet Explorer's preferences (Tools, Internet Options, Security; select â€œLocal Intranetâ€, Sites, Advanced, type in the Alfresco server name and click Add, Ok, Ok)
- Authentication seems to work only from specified domain and not from trusted domains. See [1] for more info and fixes.

C. Enable CIFS integration with AD and NTLM passtrough on the CIFS interface:
- Change the provided $ALF_SHARED_CLASSES/file-servers-custom.xml.sample –> $ALF_SHARED_CLASSES/file-servers-custom.xml
- Edit the file so that it looks as follows:

<alfresco-config area="file-servers">
  <config evaluator="string-compare" condition="CIFS Server">
    <serverEnable enabled="true" />
    <!– Insert here IP or hostname of this alfresco server, and the NT domain name in which you want to integrate–>
    <host name="alfrescoServerIPorHostname" domain="WINDOWSDOMAIN" />
    <comment>Alfresco CIFS Server</comment>
    <!– Set to the broadcast mask for the subnet –>
    <broadcast>255.255.255.255</broadcast>
    <sessionDebug flags="Negotiate,Socket" />
  </config>
  <config evaluator="string-compare" condition="Filesystems" replace="true">
    <filesystems>
      <filesystem name="Alfresco">
        <store>workspace://SpacesStore</store>
        <rootPath>/app:company_home</rootPath>
        <!– Add a URL file to each folder that links back to the web client –>
        <urlFile>
          <filename>__Alfresco.url</filename>
          <webpath>http://${localname}:8080/alfresco/</webpath>
        </urlFile>
        <!– Mark locked files as offline –>
        <offlineFiles />
        <!– Desktop actions –>
        <desktopActions>
          <global>
            <path>alfresco/desktop/Alfresco.exe</path>
            <webpath>http://${localname}:8080/alfresco/</webpath>
          </global>
          <action>
            <class>org.alfresco.filesys.smb.server.repo.desk.CheckInOutDesktopAction</class>
            <name>CheckInOut</name>
            <filename>__CheckInOut.exe</filename>
          </action>
          <action>
            <class>org.alfresco.filesys.smb.server.repo.desk.JavaScriptDesktopAction</class>
            <name>JavaScriptURL</name>
            <filename>__ShowDetails.exe</filename>
            <script>alfresco/desktop/showDetails.js</script>
            <attributes>anyFiles</attributes>
            <preprocess>copyToTarget</preprocess>
          </action>
        </desktopActions>
      </filesystem>
      <!– AVM virtualization view of all stores/versions for WCM –>
      <avmfilesystem name="AVM">
        <virtualView />
      </avmfilesystem>
    </filesystems>
  </config>
  <!– Authenticator should be of type alfresco –>
  <config evaluator="string-compare" condition="Filesystem Security" replace="true">
    <authenticator type="alfresco" />
  </config>
</alfresco-config> ‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

- Restart your afresco instance and automagically your NTLM SSO authentication should work also against the CIFS filesystem
NOTE:
- SSO+CIFS was only tested (obviously you may say) from Windows Explorer on Windows (with an AD registered user). We also tested the integration of just AD/CIFS (manual AD user login) with Linux/smbclient and Macosx/Finder but with a proper client- side OS configuration integration (at least on mac) it *should* be possible to have SSO working
- Although other authenticators seems to fit more in this configuration (e.g. NTLM, see [2]), "alfresco" type is the only working with this configuration. Don't get mistaken than Wink
- Authentication seems to work only from specified domain and not from trusted domains. See [1] for more info and fixes.

D. Enable LDAP users/groups scheduled import in order to be able to assign roles/permissions/notifications/ownerships/jobs to AD users (aka "to be able to use (not only log them in) AD users in alfresco" )
- Change the provided $ALF_SHARED_CLASSES/ldap-authentication-context.xml.sample –> $ALF_SHARED_CLASSES/ldap-authentication-context.xml
- Edit the file so that it looks as follows:

<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE beans PUBLIC '-//SPRING//DTD BEAN//EN' 'http://www.springframework.org/dtd/spring-beans.dtd'>

<beans>
  <bean id="ldapInitialDirContextFactory" class="org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl">
    <property name="initialDirContextEnvironment">
      <map>
        <!– The LDAP provider –>
        <entry key="java.naming.factory.initial">
          <value>com.sun.jndi.ldap.LdapCtxFactory</value>
        </entry>
        <!– The url to the LDAP server –>
        <!– Note you can use space separated urls - they will be tried in turn until one works –>
        <!– This could be used to authenticate against one or more ldap servers (you will not know which one ….) –>
        <entry key="java.naming.provider.url">
          <value>ldap://ldapserverurl:389</value>
        </entry>
        <!– The authentication mechanism to use      –>
        <!– Some sasl authentication mechanisms may require a realm to be set –>
        <!–                java.naming.security.sasl.realm –>
        <!– The available options will depend on your LDAP provider –>
        <entry key="java.naming.security.authentication">
          <value>simple</value>
        </entry>
        <!– The id of a user who can read group and user information –>
        <entry key="java.naming.security.principal">
          <value>WINDOWSDOMAIN\directoryadmin</value>
        </entry>
        <!– The password for the user defined above –>
        <entry key="java.naming.security.credentials">
          <value>directoryadminpassword</value>
        </entry>
      </map>
    </property>
  </bean>
  <!– Ldap Syncronisation support –>

  <!–     There can be more than one stack of beans that import users or groups. For example, it may be easier to have a version of ldapPeopleExportSource, and associated beans, for each sub-tree of your ldap directory from which you want to        import users. You could then limit users to be imported from two or more sub tress and ignore users found else where. The same applies to the import of groups.         
  –>
  <!– Extract user information from LDAP and transform this to XML –>
  <bean id="ldapPeopleExportSource" class="org.alfresco.repo.security.authentication.ldap.LDAPPersonExportSource">
    <!–
      The query to select objects that represent the users to import. For Active Directory: (objectclass=user)
    –>
    <property name="personQuery">
      <value>(objectclass=user)</value>
    </property>
    <!–
      The search base restricts the LDAP query to a sub section of tree on the LDAP server.
      In this particular example we imported only the IT Department users.
    –>
    <property name="searchBase">
      <value>ou=IT Department,dc=mycompany,dc=org</value>
    </property>
    <!–
      The unique identifier for the user.THIS MUST MATCH WHAT THE USER TYPES IN AT THE LOGIN PROMPT   
      For simple LDAP authentication this is likely to be "cn" or, less friendly, "distinguishedName"
      In Active Directory this is most likely to be "sAMAccountName". This property is mandatory and must appear on all users found by the query defined above.
    –>
    <property name="userIdAttributeName">
      <value>sAMAccountName</value>
    </property>
    <!– Services –>
    <property name="LDAPInitialDirContextFactory">
      <ref bean="ldapInitialDirContextFactory" />
    </property>
    <property name="personService">
      <ref bean="personService"></ref>
    </property>
    <property name="namespaceService">
      <ref bean="namespaceService" />
    </property>
    <!–
      This property defines a mapping between attributes held on LDAP user objects and the properties of user objects held in the repository. The key is the QName of an attribute in the repository, the value is the attribute name from the user/       inetOrgPerson/.. object in the LDAP repository.     
    –>
    <property name="attributeMapping">
      <map>
        <entry key="cm:userName">
          <!– Must match the same attribute as userIdAttributeName –>
          <value>sAMAccountName</value>
        </entry>
        <entry key="cm:firstName">
          <!– Active Directory: "givenName" –>
          <value>givenName</value>
        </entry>
        <entry key="cm:lastName">
          <!– Active Directory: "sn" –>
          <value>sn</value>
        </entry>
        <entry key="cm:email">
          <!– Active Directory: "???" –>
          <value>mail</value>
        </entry>
        <entry key="cm:organizationId">
          <!– Active Directory: "???" –>
          <value>o</value>
        </entry>
        <!– Always use the default –>
        <entry key="cm:homeFolderProvider">
          <null />
        </entry>
      </map>
    </property>
    <!– Set a default home folder provider. We configured it to create user home folder under  "User Homes" space–>
    <property name="attributeDefaults">
      <map>
        <entry key="cm:homeFolderProvider">
          <value>userHomesHomeFolderProvider</value>
        </entry>
      </map>
    </property>
  </bean>
  <!– Extract group information from LDAP and transform this to XML –>
  <bean id="ldapGroupExportSource" class="org.alfresco.repo.security.authentication.ldap.LDAPGroupExportSource">
    <!–
      The query to select objects that represent the groups to import.
      For Active Directory: (objectclass=group)
    –>
    <property name="groupQuery">
      <value>(objectclass=group)</value>
    </property>
    <!– The seach base restricts the LDAP query to a sub section of tree on the LDAP server. We reduced it to IT departments internal groups  –>
    <property name="searchBase">
      <value>ou=IT Department,dc=mycompany,dc=org</value>
    </property>
    <!–        The unique identifier for the user. This must match the userIdAttributeName on the ldapPeopleExportSource bean above.        –>
    <property name="userIdAttributeName">
      <value>sAMAccountName</value>
    </property>
    <!–   An attribute that is a unique identifier for each group found. This is also the name of the group with the current group implementation.This is mandatory for any groups found.       
      Active Directory: "cn"  –>
    <property name="groupIdAttributeName">
      <value>cn</value>
    </property>
    <!–  The objectClass attribute for group members. For each member of a group, the distinguished name is given.The object is looked up by its DN. If the object is of this class it is treated as a group. –>
    <property name="groupType">
      <value>group</value>
    </property>
    <!– The objectClass attribute for person members.For each member of a group, the distinguished name is given.The object is looked up by its DN. If the object is of this class it is treated as a person –>
    <property name="personType">
      <value>user</value>
    </property>
    <property name="LDAPInitialDirContextFactory">
      <ref bean="ldapInitialDirContextFactory" />
    </property>
    <property name="namespaceService">
      <ref bean="namespaceService" />
    </property>
    <!–
      The repeating attribute on group objects (found by query or as sub groups) used to define membership of the group. This is assumed to hold distinguished names oF other groups or users/people; the above types are used to determine this.       
      Active Directory: "member"   –>
    <property name="memberAttribute">
      <value>member</value>
    </property>
    <property name="authorityDAO">
      <ref bean="authorityDAO" />
    </property>
  </bean>
  <!– Job definitions to import LDAP people and groups –>
  <!– The triggers register themselves with the scheduler –>
  <!– You may comment in the default scheduler to enable these triggers –>
  <!– If a cron base trigger is what you want seee scheduled-jobs-context.xml for examples. –>
  <!– Trigger to load poeple Note you can have more than one initial (context, trigger, import job and export source) seT. This would allow you to load people from more than one ldap store –>
  <bean id="ldapPeopleTrigger" class="org.alfresco.util.TriggerBean">
    <property name="jobDetail">
      <bean id="ldapPeopleJobDetail" class="org.springframework.scheduling.quartz.JobDetailBean">
        <property name="jobClass">
          <value>org.alfresco.repo.importer.ImporterJob</value>
        </property>
        <property name="jobDataAsMap">
          <map>
            <entry key="bean">
              <ref bean="ldapPeopleImport" />
            </entry>
          </map>
        </property>
      </bean>
    </property>
    <!– Start after 5 minutes of starting the repository –>
    <property name="startDelay">
      <value>180000</value>
    </property>
    <!– Repeat every hour –>
    <property name="repeatInterval">
      <value>3600000</value>
    </property>
    <property name="scheduler">
      <ref bean="schedulerFactory" />
    </property>
  </bean>
  <bean id="ldapGroupTrigger" class="org.alfresco.util.TriggerBean">
    <property name="jobDetail">
      <bean id="ldapGroupJobDetail" class="org.springframework.scheduling.quartz.JobDetailBean">
        <property name="jobClass">
          <value>org.alfresco.repo.importer.ImporterJob</value>
        </property>
        <property name="jobDataAsMap">
          <map>
            <entry key="bean">
              <ref bean="ldapGroupImport" />
            </entry>
          </map>
        </property>
      </bean>
    </property>
    <!– Start after 5 minutes of starting the repository –>
    <property name="startDelay">
      <value>180000</value>
    </property>
    <!– Repeat every hour –>
    <property name="repeatInterval">
      <value>3600000</value>
    </property>
    <property name="scheduler">
      <ref bean="schedulerFactory" />
    </property>
  </bean>

  <!– The bean that imports xml describing people –>

  <bean id="ldapPeopleImport" class="org.alfresco.repo.importer.ExportSourceImporter">
    <property name="importerService">
      <ref bean="importerComponentWithBehaviour" />
    </property>
    <property name="transactionService">
      <ref bean="transactionComponent" />
    </property>
    <property name="authenticationComponent">
      <ref bean="authenticationComponent" />
    </property>
    <property name="exportSource">
      <ref bean="ldapPeopleExportSource" />
    </property>

    <!– The store that contains people - this should not be changed –>
    <property name="storeRef">
      <value>${spaces.store}</value>
    </property>

    <!– The location of people nodes within the store defined above - this should not be changed –>
    <property name="path">
      <value>/${system.system_container.childname}/${system.people_container.childname}</value>
    </property>

    <!– If true, clear all existing people before import, if false update/add people from the xml –>
    <property name="clearAllChildren">
      <value>false</value>
    </property>
    <property name="nodeService">
      <ref bean="nodeService" />
    </property>
    <property name="searchService">
      <ref bean="searchService" />
    </property>
    <property name="namespacePrefixResolver">
      <ref bean="namespaceService" />
    </property>


    <property name="caches">
      <set>
        <ref bean="permissionsAccessCache" />
      </set>
    </property>
  </bean>

  <!– The bean that imports xml descibing groups –>

  <bean id="ldapGroupImport" class="org.alfresco.repo.importer.ExportSourceImporter">
    <property name="importerService">
      <ref bean="importerComponentWithBehaviour" />
    </property>
    <property name="transactionService">
      <ref bean="transactionComponent" />
    </property>
    <property name="authenticationComponent">
      <ref bean="authenticationComponent" />
    </property>
    <property name="exportSource">
      <ref bean="ldapGroupExportSource" />
    </property>
    <!– The store that contains group information - this should not be changed –>
    <property name="storeRef">
      <value>${alfresco_user_store.store}</value>
    </property>

    <!– The location of group information in the store above - this should not be changed –>
    <property name="path">
      <value>/${alfresco_user_store.system_container.childname}/${alfresco_user_store.authorities_container.childname}</value>
    </property>

    <!– If true, clear all existing groups before import, if false update/add groups from the xml –>
    <property name="clearAllChildren">
      <value>true</value>
    </property>
    <property name="nodeService">
      <ref bean="nodeService" />
    </property>
    <property name="searchService">
      <ref bean="searchService" />
    </property>
    <property name="namespacePrefixResolver">
      <ref bean="namespaceService" />
    </property>

    <!– caches to clear on import of groups –>
    <property name="caches">
      <set>
        <ref bean="userToAuthorityCache" />
        <ref bean="permissionsAccessCache" />
      </set>
    </property>

    <!– userToAuthorityCache –>
  </bean>

</beans> ‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

- Enable automatic scheduled jobs starting editing the file $ALF_CLASSES/scheduled-jobs-context.xml by setting the autoStartup property to true in the the schedulerFactory bean definition:

    <!– Task scheduler –>
    <!– Triggers should not appear here - the scheduler should be injected into the trigger definition –>
    <!– This bean should not need to appear else where in extension configuration –>
<!– Task scheduler –>
<!– Triggers should not appear here - the scheduler should be injected into the trigger definition –>
<!– This bean should not need to apear else where in extension configuration –>
<bean id="schedulerFactory" class="org.springframework.scheduling.quartz.SchedulerFactoryBean">
  <property name="waitForJobsToCompleteOnShutdown">
    <value>true</value>
  </property>
  <property name="configLocation">
    <value>classpath:alfresco/domain/quartz.properties</value>
  </property>
  <property name="schedulerName">
    <value>DefaultScheduler</value>
  </property>
  <!– Do not auto start the scheduler - this is done at the end of the bootstrap process –>
  <property name="autoStartup">
    <value>true</value>
  </property>
</bean> ‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

- Restart alfresco and you should see (after waiting the defined time + some import time) the user/groups created in Alfresco

NOTE:
- In order to have a better understanding/debugging of the import process please note that if users are correctly imported from LDAP temporary XML files are written in $ALF_HOME/tomcat/temp/Alfresco/ExportSource*
- For a finer debugging of the whole process you may want to raise log levels for interested components, by editing $ALF_HOME/webapps/alfresco/WEB-INF/classes/log4j.properties setting the following categories to debug:


log4j.logger.org.alfresco.smb.protocol=debug
log4j.logger.org.alfresco.smb.protocol.auth=debug
log4j.logger.org.alfresco.repo.action=debug
log4j.org.alfresco.repo.security.authentication.ldap=debug
log4j.logger.org.alfresco.acegi=debug
# Thx SCHNEIKA
log4j.logger.org.alfresco.repo.security.authentication.ldap=debug ‍‍‍‍‍‍‍‍

~~~~~%%%%~~~~~

That should be it. Hope this helps.

Ciao!

[1] ihttp://wiki.alfresco.com/wiki/Configuring_NTLM#Enabling_NTLM_users
[2] http://wiki.alfresco.com/wiki/Enterprise_Security_and_Authentication_Configuration#Which_authentication_components_are_compatible_with_which_web_authentication_filters_and_filesystem_security.3F
[3] http://www.sourcesense.com

Re: NTLM and CIFS configuration

schneika — Sat, 29 Sep 2007 11:41:16 GMT

You have done a great job. :!:
With your manual i was able to establish a NTLM-Autologin and a LDAP-Synchronisation against MS-ADS in 15 Minutes instead of struggling many days with trial and error. Thanx very much. Perhaps you will publish your manual in the Wiki?

Re: NTLM and CIFS configuration

mindthegab — Mon, 01 Oct 2007 09:56:30 GMT

Thanks,
it's always important to have feedback and cross-checking when describing achievements or howto's.
As per the wiki, dunno if I can just start writing it in there or should I wait for some alfresco guy to validate the howto first?

WDYT?

Gab

Re: NTLM and CIFS configuration

schneika — Mon, 01 Oct 2007 15:10:22 GMT

Its very important to set up all the configuration.xml-files exactly as described in mindthegaps HowTo (of course except local variables).

Particulary such details like ntlm-authentication-context.xml, where in the original-sample a complete property (transactionService) is missing and so on.

Re: NTLM and CIFS configuration

schneika — Wed, 05 Dec 2007 21:25:59 GMT

Just one typo in log4j.properties:

You should try this for ldap-debug-logs:

log4j.logger.org.alfresco.repo.security.authentication.ldap=debug