topic Auto-Login (SSO) not working - Kerberos in Alfresco Forum https://connect.hyland.com/t5/alfresco-forum/auto-login-sso-not-working-kerberos/m-p/39923#M16739 <HTML><HEAD></HEAD><BODY><P><SPAN style="text-decoration: underline;"><STRONG>Question:&nbsp;NOT ABLE TO ESTABLISH SSO using Kerberos.</STRONG></SPAN></P><P></P><P><STRONG><SPAN style="text-decoration: underline;">Environment Details</SPAN>:&nbsp;</STRONG></P><P>alfresco-community-installer-201611-EA-win-x64</P><P>Windows server 2008 R2 Standard.</P><P></P><P><STRONG>***** <SPAN style="text-decoration: underline;">Find all the files in the attachments</SPAN></STRONG></P><P><SPAN style="text-decoration: underline;"><STRONG>&nbsp;</STRONG></SPAN></P><P><SPAN style="text-decoration: underline;"><STRONG>Steps Performed:</STRONG></SPAN></P><P>1) <SPAN style="color: #727174; background-color: #ffffff;">created two LDAP users -&nbsp;</SPAN><SPAN style="color: #727174; background-color: #ffffff;">name: AlfrescoHTTP,</SPAN><SPAN style="color: #727174; background-color: #ffffff;">&nbsp;password:&nbsp;***,&nbsp;</SPAN>name: AlfrescoCIFS, password: ***</P><P>2)&nbsp;a<SPAN>) <STRONG>Enable </STRONG>Password never expires.<BR />&nbsp;&nbsp;&nbsp;&nbsp;b) <STRONG>Disable </STRONG>User must change password at next logon.<BR />&nbsp;&nbsp;&nbsp;&nbsp;c) Select the <STRONG>Account</STRONG> tab and enable the <STRONG>Do not require Kerberos preauthentication</STRONG> option in the <STRONG>Account</STRONG> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Options section.<BR />&nbsp;&nbsp;&nbsp; d)</SPAN><SPAN class=""> In the user&nbsp;<SPAN style="font-weight: bold;"><STRONG class="">Delegation</STRONG></SPAN>&nbsp;tab, select the&nbsp;<SPAN style="font-weight: bold;"><STRONG class="">Trust this user for delegation to any service (Kerberos only)</STRONG></SPAN>&nbsp;check box.</SPAN></P><P>3) Created Keytab files for both users, kept at location C:\alf\ on server (aaa),&nbsp;</P><P>4) Created "krb5.ini" file on server (aaa) at location,&nbsp;C:\Windows\</P><P>5) Created "java.login.config" file at location &lt;install-path&gt;:\Alfresco\instance\java\lib\security\&nbsp;</P><P>6) Edited "java.security" file at <SPAN>&lt;install-path&gt;</SPAN>:\Alfresco\instance\java\lib\security\ path and appended following,</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;login.config.url.1=file:${java.home}/lib/security/java.login.config&nbsp;</P><P>7) Edited alfresco-global.properties file.</P><P><span class="lia-unicode-emoji" title=":smiling_face_with_sunglasses:">😎</span> Edited share-config-custom.xml file.</P><P>9) Restarted the alfresco services.</P><P></P><P></P><P><SPAN style="text-decoration: underline;"><STRONG>Log Files:</STRONG></SPAN></P><P><STRONG>alfrescotomcat-stdout.2017-06-12.log</STRONG></P><P>2017-06-12 12:34:36,168 INFO [alfresco.repo.admin] [localhost-startStop-1] Using database URL 'jdbc<img id="smileytongue" class="emoticon emoticon-smileytongue" src="https://connect.hyland.com/i/smilies/16x16_smiley-tongue.png" alt="Smiley Tongue" title="Smiley Tongue" />ostgresql://localhost:5432/alfresco' with user 'alfresco'.<BR /> 2017-06-12 12:34:36,168 INFO [alfresco.repo.admin] [localhost-startStop-1] Connected to database PostgreSQL version 9.4.4<BR /> 2017-06-12 12:34:45,980 INFO [domain.schema.SchemaBootstrap] [localhost-startStop-1] Ignoring script patch (post-Hibernate): patch.db-V4.2-metadata-query-indexes<BR /> 2017-06-12 12:34:45,980 INFO [domain.schema.SchemaBootstrap] [localhost-startStop-1] Ignoring script patch (post-Hibernate): patch.db-V5.1-metadata-query-indexes<BR /> 2017-06-12 12:34:45,980 INFO [domain.schema.SchemaBootstrap] [localhost-startStop-1] Ignoring script patch (post-Hibernate): patch.db-V5.2-remove-jbpm-tables-from-db<BR /> 2017-06-12 12:34:57,667 INFO [management.subsystems.ChildApplicationContextFactory] [localhost-startStop-1] Starting 'Authentication' subsystem, ID: [Authentication, managed, kerberos1]<BR /> 2017-06-12 12:34:57,902 DEBUG [app.servlet.KerberosAuthenticationFilter] [localhost-startStop-1] HTTP Kerberos login successful<BR /><SPAN> 2017-06-12 12:34:57,902 DEBUG [app.servlet.KerberosAuthenticationFilter] [localhost-startStop-1] Logged on using principal </SPAN><A class="jive-link-email-small" href="mailto:HTTP/HOST.comp.com@COMP.COM" rel="nofollow noopener noreferrer">HTTP/HOST.comp.com@COMP.COM</A><BR /> 2017-06-12 12:34:57,933 DEBUG [webdav.auth.KerberosAuthenticationFilter] [localhost-startStop-1] HTTP Kerberos login successful<BR /><SPAN> 2017-06-12 12:34:57,933 DEBUG [webdav.auth.KerberosAuthenticationFilter] [localhost-startStop-1] Logged on using principal </SPAN><A class="jive-link-email-small" href="mailto:HTTP/DMUAT.edelcap.com@EDELCAP.COM" rel="nofollow noopener noreferrer">HTTP/HOST.comp.com@COMP.COM</A><BR /> 2017-06-12 12:34:58,042 INFO [management.subsystems.ChildApplicationContextFactory] [localhost-startStop-1] Startup of 'Authentication' subsystem, ID: [Authentication, managed, kerberos1] complete<BR /> 2017-06-12 12:34:58,042 INFO [management.subsystems.ChildApplicationContextFactory] [localhost-startStop-1] Starting 'Authentication' subsystem, ID: [Authentication, managed, ldap1]<BR /> 2017-06-12 12:34:58,324 INFO [management.subsystems.ChildApplicationContextFactory] [localhost-startStop-1] Startup of 'Authentication' subsystem, ID: [Authentication, managed, ldap1] complete</P><P></P><P><STRONG>Alfresco.log file</STRONG></P><P>2017-06-12 17:05:21,669 DEBUG [org.alfresco.web.app.servlet.KerberosAuthenticationFilter] [http-apr-8080-exec-3] New Kerberos auth request from 127.0.0.1 (127.0.0.1:57333)<BR />2017-06-12 17:05:21,669 DEBUG [org.alfresco.web.app.servlet.KerberosAuthenticationFilter] [http-apr-8080-exec-3] Issuing login challenge to browser.<BR />2017-06-12 17:05:27,888 DEBUG [org.alfresco.web.app.servlet.KerberosAuthenticationFilter] [http-apr-8080-exec-7] New Kerberos auth request from 127.0.0.1 (127.0.0.1:57341)<BR />2017-06-12 17:05:27,888 DEBUG [org.alfresco.web.app.servlet.KerberosAuthenticationFilter] [http-apr-8080-exec-7] Issuing login challenge to browser.<BR />2017-06-12 17:05:28,044 DEBUG [org.alfresco.web.app.servlet.KerberosAuthenticationFilter] [http-apr-8080-exec-12] New Kerberos auth request from 127.0.0.1 (127.0.0.1:57341)<BR />2017-06-12 17:05:28,044 DEBUG [org.alfresco.web.app.servlet.KerberosAuthenticationFilter] [http-apr-8080-exec-12] Issuing login challenge to browser.<BR />2017-06-12 17:05:28,982 DEBUG [org.alfresco.web.app.servlet.KerberosAuthenticationFilter] [http-apr-8080-exec-15] New Kerberos auth request from 127.0.0.1 (127.0.0.1:57339)<BR />2017-06-12 17:05:28,982 DEBUG [org.alfresco.web.app.servlet.KerberosAuthenticationFilter] [http-apr-8080-exec-15] Issuing login challenge to <A href="mailto:browser.@" rel="nofollow noopener noreferrer">browser.@#</A></P><P></P><P><B>Badim Bdgei</B>‌ <B>astacey _</B>‌ <B>Aingaran Pillai</B>‌ <B>Yacine Zribi</B>‌</P><P><STRONG>Question:&nbsp;W<SPAN style="color: #222222; background-color: #ffffff;">ant to know whether the steps which are performed for Kerberso sso are correct or some more config need to be done. Not able to figure out from the logs files what is the exact error. How do I proceed further in investigating and establishing SSO.&nbsp;</SPAN></STRONG></P></BODY></HTML> Mon, 12 Jun 2017 15:57:24 GMT tanmaysalve 2017-06-12T15:57:24Z Auto-Login (SSO) not working - Kerberos https://connect.hyland.com/t5/alfresco-forum/auto-login-sso-not-working-kerberos/m-p/39923#M16739 Question:&nbsp;NOT ABLE TO ESTABLISH SSO using Kerberos.Environment Details:&nbsp;alfresco-community-installer-201611-EA-win-x64Windows server 2008 R2 Standard.***** Find all the files in the attachments&nbsp;Steps Performed:1) created two LDAP users -&nbsp;name: AlfrescoHTTP,&nbsp;password:&nbsp;***,&nbsp;name: AlfrescoCIFS, passwor Mon, 12 Jun 2017 15:57:24 GMT https://connect.hyland.com/t5/alfresco-forum/auto-login-sso-not-working-kerberos/m-p/39923#M16739 tanmaysalve 2017-06-12T15:57:24Z Re: Auto-Login (SSO) not working - Kerberos https://connect.hyland.com/t5/alfresco-forum/auto-login-sso-not-working-kerberos/m-p/39924#M16740 <HTML><HEAD></HEAD><BODY><OL style="color: #727174; background-color: #ffffff; border: 0px; padding: 0px 0px 0px 30px;"><LI style="border: 0px; font-weight: inherit; margin: 0.5ex 0px;"><A class="" href="http://host:port/alfresco" rel="nofollow noopener noreferrer" style="color: #1e88e5; border: 0px; font-weight: inherit; text-decoration: none; padding: 0px calc(12px + 0.35ex) 0px 0px;" target="_blank">http://host<img id="smileytongue" class="emoticon emoticon-smileytongue" src="https://connect.hyland.com/i/smilies/16x16_smiley-tongue.png" alt="Smiley Tongue" title="Smiley Tongue" />ort/alfresco</A><STRONG style="border: 0px; font-weight: bold;"><SPAN>&nbsp;</SPAN></STRONG>getting logged in via kerbero</LI></OL><P style="color: #727174; background-color: #ffffff; border: 0px;"><STRONG style="border: 0px; font-weight: bold;">Output:</STRONG></P><P style="color: #727174; background-color: #ffffff; border: 0px;"><STRONG style="border: 0px; font-weight: bold;"><SPAN style="color: #727174; background-color: #ffffff; border: 0px;">2017-06-12 17:05:27,888 DEBUG [org.alfresco.web.app.servlet.KerberosAuthenticationFilter] [http-apr-8080-exec-7] New Kerberos auth request from 127.0.0.1 (127.0.0.1:57341)</SPAN><BR style="color: #727174;" /><SPAN style="color: #727174; background-color: #ffffff; border: 0px;">2017-06-12 17:05:27,888 DEBUG [org.alfresco.web.app.servlet.KerberosAuthenticationFilter] [http-apr-8080-exec-7] Issuing login challenge to browser.</SPAN></STRONG></P><P style="color: #727174; background-color: #ffffff; border: 0px;"><STRONG style="border: 0px; font-weight: bold;">&nbsp;</STRONG></P><OL style="color: #727174; background-color: #ffffff; border: 0px; padding: 0px 0px 0px 30px;"><LI style="border: 0px; font-weight: inherit; margin: 0.5ex 0px;"><A class="" href="http://host:port/share" rel="nofollow noopener noreferrer" style="color: #1e88e5; border: 0px; font-weight: inherit; text-decoration: none; padding: 0px calc(12px + 0.35ex) 0px 0px;" target="_blank">http://host<img id="smileytongue" class="emoticon emoticon-smileytongue" src="https://connect.hyland.com/i/smilies/16x16_smiley-tongue.png" alt="Smiley Tongue" title="Smiley Tongue" />ort/share</A><STRONG style="border: 0px; font-weight: bold;">&nbsp;NOT&nbsp;</STRONG>getting logged in via kerberos</LI></OL><P style="color: #727174; background-color: #ffffff; border: 0px;"><STRONG style="border: 0px; font-weight: bold;">Output:</STRONG><BR />2017-06-15 13:02:35,220 DEBUG [webdav.auth.KerberosAuthenticationFilter] [http-apr-8080-exec-1] New Kerberos auth request from 10.172.0.215 (10.172.0.215:53162)<BR />2017-06-15 13:02:35,220 DEBUG [webdav.auth.KerberosAuthenticationFilter] [http-apr-8080-exec-1] Issuing login challenge to browser.<BR />2017-06-15 13:02:35,282 DEBUG [webdav.auth.KerberosAuthenticationFilter] [http-apr-8080-exec-6] Create the User environment for:&nbsp;SomeUserName<BR />2017-06-15 13:02:35,282 DEBUG [webdav.auth.KerberosAuthenticationFilter] [http-apr-8080-exec-6] User<SPAN>&nbsp;</SPAN><SPAN style="border: 0px; font-weight: inherit;">SomeUserName&nbsp;</SPAN>logged on via Kerberos<BR />2017-06-15 13:02:35,282 DEBUG [webdav.auth.KerberosAuthenticationFilter] [http-apr-8080-exec-6] Authenticated through Kerberos.<BR />2017-06-15 13:03:51,999 DEBUG [webdav.auth.KerberosAuthenticationFilter] [http-apr-8080-exec-8] Found a session user:<SPAN>&nbsp;</SPAN><SPAN style="border: 0px; font-weight: inherit;">SomeUserName</SPAN><BR />2017-06-15 13:03:51,999 DEBUG [webdav.auth.KerberosAuthenticationFilter] [http-apr-8080-exec-8] Authentication not required (user), chaining ...</P></BODY></HTML> Thu, 15 Jun 2017 07:42:56 GMT https://connect.hyland.com/t5/alfresco-forum/auto-login-sso-not-working-kerberos/m-p/39924#M16740 tanmaysalve 2017-06-15T07:42:56Z Re: Auto-Login (SSO) not working - Kerberos https://connect.hyland.com/t5/alfresco-forum/auto-login-sso-not-working-kerberos/m-p/39925#M16741 <HTML><HEAD></HEAD><BODY><P>There was issue with a module which was installed.</P><P>Once the module was uninstalled, kerberos started working</P></BODY></HTML> Tue, 25 Jul 2017 08:39:13 GMT https://connect.hyland.com/t5/alfresco-forum/auto-login-sso-not-working-kerberos/m-p/39925#M16741 tanmaysalve 2017-07-25T08:39:13Z Re: Auto-Login (SSO) not working - Kerberos https://connect.hyland.com/t5/alfresco-forum/auto-login-sso-not-working-kerberos/m-p/39926#M16742 <HTML><HEAD></HEAD><BODY><P>May I ask which module was it?</P></BODY></HTML> Tue, 25 Jul 2017 14:28:23 GMT https://connect.hyland.com/t5/alfresco-forum/auto-login-sso-not-working-kerberos/m-p/39926#M16742 douglascrp 2017-07-25T14:28:23Z Re: Auto-Login (SSO) not working - Kerberos https://connect.hyland.com/t5/alfresco-forum/auto-login-sso-not-working-kerberos/m-p/39927#M16743 <HTML><HEAD></HEAD><BODY><P>It was a custom made module.</P><P>share-config-custom.xml file placed inside of web-extension folder.</P><P>The file shouldn't have been in that location.</P></BODY></HTML> Wed, 26 Jul 2017 06:21:41 GMT https://connect.hyland.com/t5/alfresco-forum/auto-login-sso-not-working-kerberos/m-p/39927#M16743 tanmaysalve 2017-07-26T06:21:41Z