topic Re: Passthru on CIFS in Alfresco Archive

Passthru on CIFS

finner — Wed, 08 Aug 2007 12:55:23 GMT

Hi,I have the following config:file-servers-custom.xml <config evaluator="string-compare" condition="Filesystem Security" replace="true"> <authenticator type="passthru"> <Server>my.ldap.server</Server> <!– LDAP server –> </authenticator> &l

Re: Passthru on CIFS

finner — Tue, 28 Aug 2007 12:51:09 GMT

Hi,
I'm still having problems with CIFs / LDAP. The problem seems to be related to the file-servers-custom.xml config for File Security.


<config evaluator="string-compare" condition="Filesystem Security" replace="true">
      <authenticator type="passthru">
   <LocalDomain>myDomain</LocalDomain>
      </authenticator>
</config>
‍‍‍‍‍‍‍

When I have the configuration above I can connect to CIFs but it's as the user on the local machine. When I configure as


<Server>myLDAPServer</Server>
‍‍‍

It crashes on the lines in previous post above. The NTLMCtx is null.

Any ideas ?

Another quick question(s):

When do I need to have NTLM configured ?

When java.naming.security.authentication is simple ?
When java.naming.security.authentication is DIGEST-MD5 ?

Cheers
Finner

Re: Passthru on CIFS

finner — Thu, 30 Aug 2007 10:43:15 GMT

Hi,
As an afterthought I guess the real question is:
Does CIFS work with LDAP using passthru on Alfresco 2.1 Community ?

Thanks
Finner

Re: Passthru on CIFS

finner — Wed, 12 Sep 2007 12:13:17 GMT

Hi,
For anyone who is looking at CIFS with LDAP I have the following working configuration / solution.

file-servers-custom.xml


<config evaluator="string-compare" condition="Filesystem Security" replace="true">
      <authenticator type="enterprise">
      </authenticator>
</config>

‍‍‍‍‍‍‍

ldap-authentication-context.xml


<beans>
    <bean name="authenticationDao" class="org.alfresco.repo.security.authentication.DefaultMutableAuthenticationDao" >
        <property name="allowDeleteUser">
            <value>true</value>
        </property>
    </bean>    
   


   <bean id="authenticationComponent" class="my.package.LDAPAuthenticationComponentWrapper">
      <property name="LDAPInitialDirContextFactory">
         <ref bean="ldapInitialDirContextFactory"/>
      </property>
      <property name="userNameFormat">
         <value>uid=%s,ou=myUsers,dc=myDC,dc=myDC</value>         
      </property>
   </bean>




<!–   <bean id="passwordEncoder" class="net.sf.acegisecurity.providers.encoding.Md5PasswordEncoder"></bean>–>


    <bean id="ldapInitialDirContextFactory" class="my.package.LDAPInitialDirContextFactoryWrapper">
        <property name="initialDirContextEnvironment">
             <map>
                <entry key="java.naming.factory.initial">
                    <value>com.sun.jndi.ldap.LdapCtxFactory</value>
                </entry> 
                <entry key="java.naming.provider.url">
                    <value>ldap://my.ldap.server:port</value>
                </entry>
                <entry key="java.naming.security.authentication">
                    <value>simple</value>     
                </entry>
             </map>
        </property>
    </bean>
 </beans>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

The class my.package.LDAPAuthenticationComponentWrapper is implemented to use MD4 hashing as follows:


public class LDAPAuthenticationComponentWrapper extends
   LDAPAuthenticationComponentImpl {

   
public LDAPAuthenticationComponentWrapper() {
   super();
}
   
@Override
public void authenticate(String userName, char[] password) throws AuthenticationException {
   super.authenticate(userName, password);
}

@Override
public NTLMMode getNTLMMode() {
   return NTLMMode.MD4_PROVIDER;
}
   
@Override
public String getMD4HashedPassword(String userName) {
   return new String(Hex.encodeHex(md4(userName)));
}
   
private static byte[] md4(String input) 
    { 
       try 
       { 
           MessageDigest digester = MessageDigest.getInstance("MD4"); 
           return digester.digest(input.getBytes("UnicodeLittleUnmarked")); 
       } 
       catch (NoSuchAlgorithmException e) 
       { 
           throw new RuntimeException(e.getMessage(), e); 
       } 
       catch (UnsupportedEncodingException e) 
       { 
           throw new RuntimeException(e.getMessage(), e); 
       } 
    } 
}

‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

authentication-services-content.xml


. . .
    <bean id="passwordEncoder" class="org.alfresco.repo.security.authentication.MD4PasswordEncoderImpl"></bean>
. . .
‍‍‍‍‍

Hope this helps someone.
Cheers
Finner

Re: Passthru on CIFS

daliakamal2005 — Sun, 16 Sep 2007 13:41:07 GMT

Hi Finner

i tried your solution but it doesn't work as it seems that CIFS server not start as i didn't see him however there is no error at the console.

Really i will be very thankful for any help

Re: Passthru on CIFS

finner — Mon, 17 Sep 2007 07:27:52 GMT

daliakamal2005,

The logs should say "…CIFS server started…" if there is no problem, otherwise you will probably see an exception.
Before you try logging onto CIFS with LDAP try using the authenticator type "passthru" with localDomain, as follows:
file-server-custom.xml


<config evaluator="string-compare" condition="Filesystem Security" replace="true">
      <authenticator type="enterprise">
            <localDomain>youDomain</localDomain>
      </authenticator>
</config> 
‍‍‍‍‍‍‍

This way you can test the CIFS server (without LDAP) and then switch back to authenticator type "enterprise" to try connecting with an LDAP user. You shouldn't be asked for a user and password for the localDomain configuration, you will be logged into Alfresco as the local user.

Another test you could do as well is download an LDAP browser like softTerra or or JXplorer and try connecting as the user you'll be using on CIFS.


<value>uid=%s,ou=myUsers,dc=myDC,dc=myDC</value> 
‍‍‍

Also, in ldap-authentication-context.xml the above will be different. It may be that your CIFS is up and running but your ldap config isn't correct.
Hope this helps you out
Finner

Re: Passthru on CIFS

daliakamal2005 — Wed, 19 Sep 2007 14:38:09 GMT

thx Finner for fast reply
I tried what u told me and u was rigth the CIFS server is starting
but still the CIFS can't be open

so i ask the getMD4HashedPassword(String userName) method should return the password not the username

So could u help me again

Re: Passthru on CIFS

finner — Wed, 19 Sep 2007 15:34:49 GMT

Hi daliakamal2005,
I'm not sure what your question is.
The getMD4..() method returns a String representing the hashed username.
Have you tried logging in as the local user ?

Try setting a breakpoint in the class org.alfresco.filesys.server.config.ServerConfiguration starting from the line below.


        // Check if an authenticator has been specified

        ConfigElement authElem = config.getConfigElement("authenticator");
        if (authElem != null)
‍‍‍‍‍‍

The first step to check your CIFS is to configure it for passthru and <localDomain> at least youÃ‚Â´ll know that's working. Then again LDAP.

Finner

Re: Passthru on CIFS

daliakamal2005 — Thu, 20 Sep 2007 09:41:32 GMT

Hi Finner sorry again if my question wasn't clear:

I did the following:

First I test local Domain as u suggestedNote passuthr authinticator can only work with LDPA or NTLM )

1. I add the ldap-authentication-context.xml

<beans> 
    <bean name="authenticationDao" class="org.alfresco.repo.security.authentication.DefaultMutableAuthenticationDao" > 
        <property name="allowDeleteUser"> 
            <value>true</value> 
        </property> 
    </bean>    
   
   <bean id="authenticationComponent" class="org.alfresco.repo.security.authentication.ldap.LDAPAuthenticationComponentImpl"> 
      <property name="LDAPInitialDirContextFactory"> 
         <ref bean="ldapInitialDirContextFactory"/> 
      </property> 
      <property name="userNameFormat"> 
         <value>%s</value>          
      </property> 
   </bean> 

<!–   <bean id="passwordEncoder" class="net.sf.acegisecurity.providers.encoding.Md5PasswordEncoder"></bean>–> 

    <bean id="ldapInitialDirContextFactory" class="org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl"> 
        <property name="initialDirContextEnvironment"> 
             <map> 
                <entry key="java.naming.factory.initial"> 
                    <value>com.sun.jndi.ldap.LdapCtxFactory</value> 
                </entry> 
                <entry key="java.naming.provider.url"> 
                   <!– <value>ldap://172.18.1.4:389</value> –>
                    <value>ldap://172.18.7.1:389</value> 
                </entry> 
                <entry key="java.naming.security.authentication"> 
                    <value>simple</value>      
                </entry> 
             </map> 
        </property> 
    </bean> 
 </beans> ‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

2. Modify the file-servers-custom.xml to add the following part:

<config evaluator="string-compare" condition="Filesystem Security" replace="true">
       <authenticator type="passthru">
           <LocalDomain/> or <Domain>domainName</Doamin>
      </authenticator>
     </config> ‍‍‍‍‍

In this case i can login from the pc that alfersco installed on it only, and failed to logon from any another pc even it is on te same Domain.
for the web no problem in the authentication.

Secondly i apply ur solution:
1. Modify the authenticationComponent bean to refer to ur wrapper calss

2. Modify the file-servers-custom.xml to use enterprise authenticator

 <config evaluator="string-compare" condition="Filesystem Security" replace="true">
       <authenticator type="enterprise">
      </authenticator>
     </config>‍‍‍‍

In this case no pc in my domain can connect to the CIFS server, even the authintacation work suceffuly on the web

so when trace in the code i find it stop at this line (//HERE) in the EnterpriseCifsAuthenticator Class

int i = 0;

       while ( i < clientHash.length && clientHash[i] == localHash[i])
                        i++;
                   
        if ( i != clientHash.length)
           {
                  //  Return a logon failure
                //HERE
                  throw new SMBSrvException( SMBStatus.NTLogonFailure, SMBStatus.DOSAccessDenied, SMBStatus.ErrDos);
                    }‍‍‍‍‍‍‍‍‍‍‍

so now can u give any advice to me, plz, i need ur help it is really works with u.

thx a lot

Re: Passthru on CIFS

finner — Thu, 20 Sep 2007 13:57:42 GMT

Hi,
I just noticed that in the LDAP config file it is configured for the default alfresco class and not the one you want to use so…

ldap-authentication-context.xml



. . .

<bean id="authenticationComponent" class="THE.PACKAGE.AND.CLASSNAME.OF.YOUR.LDAP.CLASS">
      <property name="LDAPInitialDirContextFactory">
         <ref bean="ldapInitialDirContextFactory"/>
      </property>
      <property name="userNameFormat">
. . .
‍‍‍‍‍‍‍‍‍‍‍

Also, I would advise you to edit your last post and remove the LDAP IP and port in your config file.

Put a breakpoint in your MD4 methods as well and see if the they are being called.
Ok, let me know how that goes.

Finner

Re: Passthru on CIFS

daliakamal2005 — Sat, 22 Sep 2007 11:19:32 GMT

<beans> 
    <bean name="authenticationDao" class="org.alfresco.repo.security.authentication.DefaultMutableAuthenticationDao" > 
        <property name="allowDeleteUser"> 
            <value>true</value> 
        </property> 
    </bean>    
   
   <bean id="authenticationComponent" class="org.alfresco.repo.security.authentication.ldap.LDAPAuthenticationComponentImpl"> 
      <property name="LDAPInitialDirContextFactory"> 
         <ref bean="ldapInitialDirContextFactory"/> 
      </property> 
      <property name="userNameFormat"> 
         <value>%s</value>          
      </property> 
   </bean> 

<!–   <bean id="passwordEncoder" class="net.sf.acegisecurity.providers.encoding.Md5PasswordEncoder"></bean>–> 

    <bean id="ldapInitialDirContextFactory" class="org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl"> 
        <property name="initialDirContextEnvironment"> 
             <map> 
                <entry key="java.naming.factory.initial"> 
                    <value>com.sun.jndi.ldap.LdapCtxFactory</value> 
                </entry> 
                <entry key="java.naming.provider.url"> 
                    <value>ldap://x.x.x.x:389</value> 
                </entry> 
                <entry key="java.naming.security.authentication"> 
                    <value>simple</value>      
                </entry> 
             </map> 
        </property> 
    </bean> 
 </beans> ‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

2. Modify the file-servers-custom.xml to add the following part:

<config evaluator="string-compare" condition="Filesystem Security" replace="true">
       <authenticator type="passthru">
           <LocalDomain/> or <Domain>domainName</Doamin>
      </authenticator>
     </config> ‍‍‍‍‍

 <config evaluator="string-compare" condition="Filesystem Security" replace="true">
       <authenticator type="enterprise">
      </authenticator>
     </config>‍‍‍‍

int i = 0;

       while ( i < clientHash.length && clientHash[i] == localHash[i])
                        i++;
                   
        if ( i != clientHash.length)
           {
                  //  Return a logon failure
                //HERE
                  throw new SMBSrvException( SMBStatus.NTLogonFailure, SMBStatus.DOSAccessDenied, SMBStatus.ErrDos);
                    }‍‍‍‍‍‍‍‍‍‍‍

so now can u give any advice to me, plz, i need ur help it is really works with u.

thx a lot

Re: Passthru on CIFS

daliakamal2005 — Sat, 22 Sep 2007 11:52:47 GMT

Hi Finner

About ur notice that i used the default alfresco calss to authenticationComponent bean this was is the first case.But in the Second case i wrote that I
'Modify the authenticationComponent bean to refer to ur wrapper calss'

As i told u at the runtime the code enter this block

if ( i != clientHash.length)
           {
            //  Return a logon failure
           throw new SMBSrvException(SMBStatus.NTLogonFailure,SMBStatus.DOSAccessDenied, SMBStatus.ErrDos);}‍‍‍‍

and this happen becuase clientHash array its elements not equal the localhash array

so i ask u again shouldn't the getMD4HashedPassword(String userName)method return the hashed password fot this user not the hashed username.

so pls can u give me anyway to communitcate with u online if it works with u.

Finally thx a lot of time as i know that i am taking a lot of it.

Re: Passthru on CIFS

jimbo762 — Tue, 02 Oct 2007 15:22:30 GMT

This is probably a dumb question, but when you say

The class my.package.LDAPAuthenticationComponentWrapper is implemented to use MD4 hashing as follows:

What do you mean?
i understand changing the file to point to the new class, but where do i put the class?
Thanks
Jim

Re: Passthru on CIFS

finner — Fri, 05 Oct 2007 06:25:33 GMT

Hi daliakamal2005,

so i ask u again shouldn't the getMD4HashedPassword(String userName)method return the hashed password fot this user not the hashed username.

I agree with you, I would expect to recieve the password in the parameter, hash it and then return the hashed password, but I'm also receiving the username. Maybe someone else can explain why it's the username..??
I've also had the same exception as you are getting but only in debug and it doesn't happen all the time. That suggests threads to me but I don't have any time to investigate it.
What is your passwordEncoder ? Do you you have something similar to:

authentication-services-context.xml


    <bean id="passwordEncoder" class="org.alfresco.repo.security.authentication.MD4PasswordEncoderImpl"></bean>
‍‍‍

Jim,

This is probably a dumb question, but when you say
Quote:
The class my.package.LDAPAuthenticationComponentWrapper is implemented to use MD4 hashing as follows:
What do you mean?
i understand changing the file to point to the new class, but where do i put the class?

I don't understand your question ????
My LDAPAuthenticationComponentWrapper extends the Alfresco class AuthLDAPAuthenticationComponentImpl and I override the getMD4HashedPassword() method. This class goes into a JAR which then goes into the Alfresco.war…………..

Is that what you mean when you ask where does it go ?

Re: Passthru on CIFS

jimbo762 — Fri, 05 Oct 2007 16:59:12 GMT

Yes, that is what i do not know about. How does one accomplish this:

This class goes into a JAR which then goes into the Alfresco.war

Yes, i'm new to this class and war thing 🙂
Thanks
Jim

Re: Passthru on CIFS

kevinr — Thu, 11 Oct 2007 09:45:16 GMT

The file format of both WAR and JAR is a simple ZIP file. You can use any ZIP application such as WinZIP or WinRAR or whatever to unpack it. You can then modify the files on your file system and use the ZIP application to repack up the JAR/WAR.

Thanks,

Kevin

Re: Passthru on CIFS

davidw — Tue, 04 Dec 2007 10:15:00 GMT

What imports should be used when compiling the class-file?

Would it be possible to provide a step by step guide for creating the jar file, or post the jar file somewhere for us that are not used to working with java?

Thanks,
David

Re: Passthru on CIFS

kevinr — Tue, 04 Dec 2007 11:01:21 GMT

You'll need to download the SDK to build the JAR files - it includes all 3rd party JARs and ANT build scripts.

If someone has compiled the JAR we can host it somewhere if they make it available.

Thanks,

Kevin