topic Re: Disabling guest access in Alfresco Archive

Disabling guest access

rbramley — Thu, 23 Feb 2006 13:02:53 GMT

There doesn't seem to be a configuration parameter to enable/disable guest access…org.alfresco.repo.security.authentication.AbstractAuthenticationComponent declares protected abstract boolean implementationAllowsGuestLogin();‍‍and org.alfresco.repo.security.authentication.AuthenticationComponentI

Re: Disabling guest access

steve — Thu, 23 Feb 2006 13:30:00 GMT

Hello,

You can disable guest access within the authentication-services-context.xml

The relevant section is:


    <bean id="authenticationComponentImpl" class="org.alfresco.repo.security.authentication.AuthenticationComponentImpl">
        <property name="authenticationDao">
            <ref bean="alfDaoImpl" />
        </property>
        <property name="authenticationManager">
            <ref bean="authenticationManager" />
        </property>
        <property name="allowGuestLogin">
            <value>true</value>
        </property>
    </bean>‍‍‍‍‍‍‍‍‍‍‍‍

Change


        <property name="allowGuestLogin">
            <value>true</value>
        </property>
‍‍‍‍‍

To:


        <property name="allowGuestLogin">
            <value>false</value>
        </property>
‍‍‍‍‍

You can use the new extension configuration functionality to change this setting: see here

Hope this helps,

Steve

Re: Disabling guest access

jora — Mon, 04 Sep 2006 13:39:59 GMT

when disabling the guest access, the link "Guest Home" is still visible. Can this also be disabled? Thanks.

Re: Disabling guest access

kevinr — Tue, 26 Sep 2006 09:11:31 GMT

Not currently, please raise this as a JIRA issue.

Thanks,

Kevin

Re: Disabling guest access

konalexiou — Fri, 15 Feb 2008 10:02:24 GMT

when disabling the guest access, the link "Guest Home" is still visible. Can this also be disabled? Thanks.

I noticed that it disappears when deleting the 'Guest Home' space. Is this a good way to disable the Guest Home ?

I am also trying to disable the Guest user and can't get it done.
I have installed the latest AlfrescoCommunity-2.9.0B in a Windows 20003 Server.
Can anybody help me with this ?

authentication-services-context.xml doesn't exist and even if i create it, still doesn't work.
also tried with ntlm-authentication-services-context.xml and can't work it out.

Re: Disabling guest access

monitloth — Fri, 21 Nov 2008 09:45:20 GMT

If you use LDAP, you must also deactivate guest in his configuration file.

Re: Disabling guest access

pescha — Wed, 20 May 2009 19:23:18 GMT

It appears that the above instructions no longer apply for Alfresco 3.2 preview 2

What is the new method for disabling guest access?

Re: Disabling guest access

dward — Thu, 21 May 2009 09:11:37 GMT

In the very latest nightly builds, it's just a matter of setting

alfresco.authentication.allowGuestLogin=false

in your custom-repository.properties if you are using the preconfigured authentication chain.

For the preview release, this method of propagating defaults to the subsystems wasn't complete. So instead you have to provide an instance-specific override file.

So suppose your authentication.chain looks like the default one in repository.properties

authentication.chain=alfrescoNtlm1:alfrescoNtlm

This has a single instance called 'alfrescoNtlm1' of type alfrescoNtlm. Interestingly enough the alfrescoNtlm authentication subsystem type is capable of handling NTLM single-sign on but this is switched off by default.

Subsystem properties can be oveerriden in a classpath file with path

alfresco/extension/subsystems/<category>/<type>/<instance>

So to configure the alfrescoNtlm1 subsystem's properties, copy root\projects\repository\config\alfresco\subsystems\Authentication\alfrescoNtlm\alfresco-authentication.properties to %TOMCAT_HOME%\shared\classes\alfresco\extension\subsystems\Authentication\alfrescoNtlm\alfrescoNtlm1\alfresco-authentication.properties and then edit as required.

A more complex authentication chain might look like this

authentication.chain=alfrescoNtlm1:alfrescoNtlm,ldap1:ldap,ldap2:ldap

In which case you could configure each authentication subsystem instance separately using property files with appropriate paths.

More details on the new improved authentication chaining and configuring subsystems will be posted on the Wiki shortly.

Re: Disabling guest access

pescha — Thu, 21 May 2009 18:19:31 GMT

I followed your instructions and now Alfresco does not login directly to guest by default. However, in the login window, I am still able to login as guest/guest. Is there a way to just delete the guest account altogether?

Re: Disabling guest access

kevinr — Fri, 19 Jun 2009 08:55:48 GMT

Wiki docs for Alfresco Subsystems in 3.2 is starting to appear here: http://wiki.alfresco.com/wiki/Alfresco_Subsystems


As of Alfresco version 3.2, the subsystems are:

Authentication
    Handles all Alfresco's authentication related functions, including:

        * Password-based authentication
        * Single Sign-on (SSO) for WebClient, WebDAV, Web Scripts and Sharepoint
        * CIFS and FTP authentication
        * User registry export (LDAP only) 

    The subsystem is 'chained' so that multiple instances of different types can be configured and used together 
Synchronization
    Performs regular synchronization with the user registry exporters (usually LDAP directories) in the authentication chain 
File Servers
    Owns the CIFS, FTP and NFS servers 
Third Party
    Owns the OpenOffice, Swftools and ImageMagick content transformers 
IMAP
    Owns the IMAP service 
WCM Deployment Receiver 
    Part of WCM. WCM_Deployment_Engine 
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Kevin

Re: Disabling guest access

rdanner — Sun, 21 Jun 2009 23:35:06 GMT

Just to keep this thread up to date:

the spring code has been updated and should now be:

    <bean id="authenticationComponent"
          class="org.alfresco.repo.security.authentication.AuthenticationComponentImpl" 
          parent="authenticationComponentBase">
        <property name="authenticationDao">
            <ref bean="authenticationDao" />
        </property>
        <property name="authenticationManager">
            <ref bean="authenticationManager" />
        </property>
        <property name="allowGuestLogin">
            <value>fasle</value>
        </property>
        <property name="nodeService">
            <ref bean="nodeService" />
        </property>
        <property name="personService">
            <ref bean="personService" />
        </property>
        <property name="transactionService">
            <ref bean="transactionService" />
        </property>
    </bean>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

in your shared/classes/alfresco/extension area, add the above to your modified spring configuration.

I'd like to see this pulled out as a property in custom-repository.properties. I'll check and see if there is a ticket for this - would make things much cleaner/easier.

Hello,

You can disable guest access within the authentication-services-context.xml

The relevant section is:


    <bean id="authenticationComponentImpl" class="org.alfresco.repo.security.authentication.AuthenticationComponentImpl">
        <property name="authenticationDao">
            <ref bean="alfDaoImpl" />
        </property>
        <property name="authenticationManager">
            <ref bean="authenticationManager" />
        </property>
        <property name="allowGuestLogin">
            <value>true</value>
        </property>
    </bean>‍‍‍‍‍‍‍‍‍‍‍‍

Change


        <property name="allowGuestLogin">
            <value>true</value>
        </property>
‍‍‍‍‍

To:


        <property name="allowGuestLogin">
            <value>false</value>
        </property>
‍‍‍‍‍

You can use the new extension configuration functionality to change this setting: see here

Hope this helps,

Steve

Re: Disabling guest access

gronfelt — Thu, 06 Aug 2009 06:57:37 GMT

I have an authentication chain looking like this:

authentication.chain=ldap1:ldap,ldap2:ldap
‍‍

In the properties files for each instance the following property is set:

ldap.authentication.allowGuestLogin=false
‍‍

However, Alfresco keeps spitting out error messages like this all the time:

08:31:07,840 ERROR [org.alfresco.web.scripts.AbstractRuntime] Exception from executeScript - redirecting to status template error: 07061383 Guest authentication not supported‍

My guess would be that Alfresco wants to authenticate the Guest account, but that's not possible since I've disabled the internal authentication. Any ideas on how to fix this the proper way?

Re: Disabling guest access

kevinr — Thu, 06 Aug 2009 08:19:45 GMT

Are you using Share? As i have a feeling there may be an issue in 3.2 where the Guest account is required for it to work - we are looking at this to solve a similar issue with NTLM.

Re: Disabling guest access

gronfelt — Thu, 06 Aug 2009 09:26:40 GMT

Yes, I'm using Share. I will try to enable guest authentication in my ldap properties files and then add a Guest user to one of my ldap directories, that should do the trick, right?

Re: Disabling guest access

ofrxnz — Mon, 10 Aug 2009 14:34:02 GMT

hey, im using kerberos, i get a similar error when i start with a blank repository….

though, if i start alfresco with the absolute default authentication mechanism once, then switch back to kerberos without guest access it seems to work…until i completely blank out the database/data files again…