topic How to make SSO work? in Alfresco Forum

How to make SSO work?

janmussche — Mon, 09 Oct 2017 16:25:36 GMT

Hi all, I've been working in setting up Alfresco for the last 3 weeks and although the program itself works fine, I can not get SSO to work. The situation is like this:We have a Windows AD where everyone in our company is situated.I have installed the Community Edition onto a Ubuntu 16.04 server in

Re: How to make SSO work?

angelborroy — Mon, 09 Oct 2017 18:01:47 GMT

I've followed several times in the past the official guide and it works properly: Configuring Kerberos | Alfresco Documentation

I don't know what additional information is required for Kerberos SSO configuration...

Re: How to make SSO work?

janmussche — Tue, 10 Oct 2017 04:20:53 GMT

Thank you for your answer but as I wrote it is not the answer I was hoping for. I did read all the Alfreso documentation, followed it to the letter and still it doesn't work so I was hoping somebody could tell me step-by-step what he did to make it work. I must be missing something and until I know what that is it will never work.

Re: How to make SSO work?

angelborroy — Tue, 10 Oct 2017 06:15:00 GMT

IMO there is no other documentation that would help you. Probably you have to test every component to verify if it is working properly: Active Directory authentication, Kerberos configuration in AD, Kerberos client in Alfresco server, client configuration for SSO...

Re: How to make SSO work?

janmussche — Tue, 10 Oct 2017 09:14:13 GMT

Hello Angel,

Thanks again for your answer. I literally read a 1001 pages in the documentation and still I can not get SSO to work.

Could you please explain what it is you did to make it work, the settings you made (without private info of course), the extras you installed. Did you make all the settings in the alfresco-global.properties file or did you also use other properties files (saw in some documentation it is also possible to use others for special purposes).

I sure can use all the help there is cause, as I wrote in the first post, I am busy for 3 weeks already and still it doesn't work.

I can log-in using the LDAP credentials, so the connections to the AD server exist, but the idea is to make it automatically without the need to log-in again when opening the website.

Thanks.

Re: How to make SSO work?

angelborroy — Tue, 10 Oct 2017 12:13:33 GMT

I can attach a sample configuration in Docker.

The only thing missed is AD configuration and also you have to re-generate keytabs and so with your server names and domain names.

Re: How to make SSO work?

mehe — Wed, 11 Oct 2017 08:34:00 GMT

Hi Jan,

could we have a little more context for your question? You say you can login with the AD credentials - so SSO is working. You also want "auto login" on share?

What technology should be used? Kerberos, NTLM or some kind of CAS (I would use Kerberos, like Angel proposed above, NTLMv1 will be dropped by Windows). LDAP alone is not sufficient to get auto-login working with standard-AD.

Can you provide what you have configured? You need to modify at least alfresco-global.properties and share-config-custom.xml.

Do you use the alfresco CIFS server?

Kerberos is bound to the same/shared "time"-source to avoid deviations - Is your Unix server using the AD as timeserver or the same one as the AD?

I use alfresco community 201707 on ubuntu 16.04 LTS in a few installations with AD but they are still using NTLMv1... have to change that...

Re: How to make SSO work?

janmussche — Thu, 12 Oct 2017 14:57:10 GMT

Hello Martin,

Wow, you ask alot of questions. But that's a good thing.

I have to explain something first: I was under the impression that SSO means logging in without a login screen, automatically using your Windows credentials with which you logged in to the active directory. Turns out I am wrong and it means logging in by typing name and password which are then authenticated by the ones stored in AD.

What I want is this:

user opens the webpage and instead of seeing the login page he(she) sees his(her) dashboard. Login happened in the background by using the users credentials he (she) used when logging in to the AD already. It means you only login once to your computer, actually to the domain, and that's it. No more having to type name and password.

I have this in the alfresco-gloal.properties file:

### authentication.chain=alfinst:alfrescoNtlm,ldap1:ldap-ad
authentication.chain=alfinst:alfrescoNtlm,ldap1:ldap-ad

### Ntlm ###
ntlm.authentication.sso.enabled=false
#ntlm.authentication.sso.fallback.enabled=true
#ntlm.authentication.mapUnknownUserToGuest=false
#alfresco.authentication.authenticateCIFS=false
#alfresco.authentication.allowGuestLogin=false

### LDAP ###
ldap.authentication.allowGuestLogin=false
ldap.authentication.userNameFormat=%s@Domain
ldap.authentication.java.naming.provider.url=ldap://Domain-controller.Domain:389
ldap.authentication.defaultAdministratorUserNames=administrator
ldap.synchronization.java.naming.security.principal=CN=alfresco_ldap,OU=Group,DC=Domain,DC=Local
ldap.synchronization.java.naming.security.credentials=Password
ldap.synchronization.groupSearchBase=OU=Groups,DC=Domain,DC=Local
ldap.synchronization.userSearchBase=OU=Company-name,DC=Domain,DC=Local

I did not change the share-config-custom.xml file and I don't have separate files and folders for each type of authentication.

Logging in by typing my domain name and password works, so there is no need for an internal database with users and passwords. I just like to see it a bit more automated (without having to type the credentials).

Is that possible? And if so, how do I do that?

Thank you for all your help.

Re: How to make SSO work?

angelborroy — Thu, 12 Oct 2017 16:26:57 GMT

You are not including Kerberos (SSO) configuration... Did you read the tutorials and the Docker I gave you?

Re: How to make SSO work?

janmussche — Thu, 12 Oct 2017 18:37:21 GMT

Hi Angel,

I absolutely know nothing about Docker. Looked at your files but they mean nothing to me.

I have the Alfresco authentication part working so I was not going to change that, although I have been looking at the kerberos way of doing things. Found it complicated to say the least.

I was hoping to find a way to get rid of the login screen but when that does not work then the users just have to login manually. Will get some comment but that's okay.

Thanks for your help.

Re: How to make SSO work?

angelborroy — Thu, 12 Oct 2017 19:10:37 GMT

To configure SSO (which is the way of avoiding the login screen) you need to use Kerberos. This is the right approach.

Configuring Kerberos is well documented and available as part of the Alfresco official documentation: Configuring Kerberos | Alfresco Documentation

Re: How to make SSO work?

janmussche — Thu, 12 Oct 2017 20:23:13 GMT

Now I am lost:

Martin writes:

You say you can login with the AD credentials - so SSO is working. You also want "auto login" on share?

You write:

To configure SSO (which is the way of avoiding the login screen)

What does SSO mean? When it is configured in the right way do I still get the login screen or not? That is what I want, or better it is what the users want.

Re: How to make SSO work?

mehe — Sat, 14 Oct 2017 13:35:41 GMT

SSO means, you have to login at a single point and having, in the best case, only one source for your credentials. The source is your AD.

Now you imported all your users to alfresco with the ldap sync - your users are known to alfresco now.

In your authentication chain you have configured alfrescoNTLM, which allows you to login with local alfresco users like admin or guest and

ldap-ad which hands over the authentication for all users that are no alfresco internal users to your AD.

That's why you are able to login with your AD users (looks like you are using ldap authentication now).

But like Angel said, you don't have a mechanism that allows to automatically login or enables Alfresco to know that you are already authorized. You need either "NTLM" which enables your Browser to "login" (sends ntlm credentials) to share or Kerberos, that is handling authorization via tickets.

Using NTLM you would have to use (I think) also passthru1assthru in the authentication chain and ntlm.authentication.sso.enable=true and tell Alfresco which server to use for passthru: passthru.authentication.servers=YOUR_AD_SERVER

Also tell your client OS that it is ok use NTLMv1. in Windows:

[HKLM\SYSTEM\CurrentControlSet\Control\Lsa] "LmCompatibilityLevel"=dword:00000001

If using Firefox as browser you also have to use about:config and set
network.automatic-ntlm-auth.trusted-uris=YOUR_ALFRESCO_SERVER_HTTP

for NTLM and

network.negotiate-auth.trusted-uris=YOUR_ALFRESCO_SERVER_HTTP

for Kerberos.

For Kerberos, you have to prepare your AD and Alfresco using the vast Informations under the link Angel provided (Configuring Kerberos | Alfresco Documentation ) which shows the needed steps:

Enabling Kerberos authentication

Use this information to enable and configure Kerberos authentication in Alfresco Community Edition 5.2.

Kerberos configuration requires three main tasks.

You don't have kerberos in your authentication chain - seems that you haven't used the docs...

AND: you'd have to configure share-config-custom.xml (see the comments in this file, search for kerberos)

If you configure your Alfresco SSO with NTLM or Kerberos (which is recommended) and your clients, you won't have to login manually to share - you will be authorized automatically.

Re: How to make SSO work?

Veriago — Sat, 22 Aug 2020 08:30:14 GMT

In addition I can say that when using such technology Active Directory and SSO you can additionally secure the authorization system through adfs sso which in turn makes it possible to set an additional password which is generated using one time security tokens.With this method, adfs authentication acts as a guarantor of 2FA protection.