topic Re: Problems on Configuring SSO (Kerberos )against Active Directory in Alfresco Forum

Problems on Configuring SSO (Kerberos )against Active Directory

mbedoui — Thu, 08 Mar 2018 17:05:57 GMT

I have installed Alfresco Community Edition V5.0.0 on Ubuntu After configuring alfresco-global.properties , import of users from AD works very well after that ,I 'm looking for enabling kerberos with alfresco and Active Directory that's why i have followed the documentation starting by : creating a

Re: Problems on Configuring SSO (Kerberos )against Active Directory

angelborroy — Mon, 12 Mar 2018 14:32:20 GMT

Sorry, I cannot understand what's your problem.

What is not working?

Re: Problems on Configuring SSO (Kerberos )against Active Directory

mbedoui — Mon, 12 Mar 2018 14:56:08 GMT

the first point , i doubt that kerberos is well configured cause the file 'alfresco.log' don't contain any indication to sso but synchronization of users from ldap works very well that's why i'm looking to the file where login operation is written.

Second point it's not work as we except ::

But the current situation is a login page that enable user connects to the share based on his ldap credentials .

It requires some investigation on logging file to understand the cause .Thanks

Re: Problems on Configuring SSO (Kerberos )against Active Directory

mbedoui — Mon, 12 Mar 2018 16:22:01 GMT

Ouups a warning in alfresco.log

2018-03-12 17:11:58,375 WARN [org.alfresco.web.app.servlet.NTLMAuthenticationFilter] [http-apr-8080-exec-1] NTLM filter, error resolving CIFS host nameGEDALFRESCOA
2018-03-12 17:11:58,376 INFO [org.alfresco.web.app.servlet.NTLMAuthenticationFilter] [http-apr-8080-exec-1] NTLM filter using server name gedAlfresco

FYI: a hostname is gedAlfresco , with a FQDN http://gedalfresco.gct.com.tn:8080/share/page/ returns Login authentication failed. Please close and re-open Safari to try again. on chrome but the login page appears on IE .

Re: Problems on Configuring SSO (Kerberos )against Active Directory

angelborroy — Mon, 12 Mar 2018 18:14:27 GMT

Configuring Kerberos always is a painful experience. You have to be very precise with every configuration, or it will be a mess in the end.

Let me share with you some tips about the process that I'm missing in your steps.

Install JCE without restrictions

Download JCE Unlimited Strength from Oracle (http://www.oracle.com/technetwork/java/javase/downloads/jce8-download-2133166.html) and install it on your server

$ unzip jce_policy-8.zip
$ cd UnlimitedJCEPolicyJDK8/
$ cp local_policy.jar /usr/java/jdk1.8.0_111/jre/lib/security/
$ cp US_export_policy.jar /usr/java/jdk1.8.0_111/jre/lib/security/

Double-check names everywhere

If you miss one server name or domain name, the configuration will fail. Double check your domain (GCT.COM.TN) and admin server (srv-adgctgab.gct.com.tn) for every step.

Verify Kerberos client from command line

You can be sure that your kerberos client is working fine from server command line and discard this point of failure.

(Names in the following sample could not be exact)

$ kinit ADUser@GCT.COM.TN
Password for ADUser@GCT.COM.TN:

$ klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: ADUser@GCT.COM.TN

Valid starting Expires Service principal
31/07/17 09:50:16 31/07/17 19:50:16 krbtgt/GCT.COM.TN@GCT.COM.TN
 renew until 01/08/17 09:50:07

$ kdestroy

$ klist -k -t /opt/alfresco/keytab/alfrescohttp.keytab
Keytab name: FILE:/opt/alfresco/keytab/alfrescohttp.keytab
KVNO Timestamp Principal
---- ----------------- --------------------------------------------------------
 0 01/01/70 01:00:00 HTTP/gedAlfresco.gct.com.tn@GCT.COM.TN
 0 01/01/70 01:00:00 HTTP/gedAlfresco.gct.com.tn@GCT.COM.TN
 0 01/01/70 01:00:00 HTTP/gedAlfresco.gct.com.tn@GCT.COM.TN
 0 01/01/70 01:00:00 HTTP/gedAlfresco.gct.com.tn@GCT.COM.TN
 0 01/01/70 01:00:00 HTTP/gedAlfresco.gct.com.tn@GCT.COM.TN

$ kinit -k -t /opt/alfresco/keytab/alfrescohttp.keytab HTTP/gedAlfresco.gct.com.tn@GCT.COM.TN

$ klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: HTTP/gedAlfresco.gct.com.tn@GCT.COM.TN

Valid starting Expires Service principal
02/08/17 14:58:00 03/08/17 00:58:00 krbtgt/GCT.COM.TN@GCT.COM.TN
 renew until 03/08/17 14:57:55

Authentication chain in alfresco.war

Verify authentication chain and users configuration in repository.

$ vi /opt/alfresco/tomcat/shared/classes/alfresco-global.properties

authentication.chain=alfinst:alfrescoNtlm,kerberos1:kerberos,ldap1:ldap-ad

# Kerberos
kerberos.authentication.realm=GCT.COM.TN
kerberos.authentication.user.configEntryName=Alfresco
kerberos.authentication.defaultAdministratorUserNames=administrator,admin,adminAlfresco,administrador
kerberos.authentication.cifs.configEntryName=AlfrescoCIFS
kerberos.authentication.cifs.password=xxxxxxxxx
kerberos.authentication.http.configEntryName=AlfrescoHTTP
kerberos.authentication.http.password=xxxxxxxxx
kerberos.authentication.sso.enabled=true

Remote section in share.war

Verify your Kerberos credentials and uncomment remote connector in Share webapp.

$ vi /opt/alfresco/tomcat/shared/classes/alfresco/web-extension/share-config-custom.xml

 <config evaluator="string-compare" condition="Kerberos" replace="true">
     <kerberos>
         <password>xxxxxxxxx</password>
         <realm>GCT.COM.TN</realm>
         <endpoint-spn>HTTP/gedAlfresco.gct.com.tn@GCT.COM.TN</endpoint-spn>
         <config-entry>ShareHTTP</config-entry>
         <stripUserNameSuffix>true</stripUserNameSuffix>
     </kerberos>
 </config>

 <config evaluator="string-compare" condition="Remote">
 <remote>
<!-- 
 <ssl-config>
 <keystore-path>alfresco/web-extension/alfresco-system.p12</keystore-path>
 <keystore-type>pkcs12</keystore-type>
 <keystore-password>alfresco-system</keystore-password>

<truststore-path>alfresco/web-extension/ssl-truststore</truststore-path>
 <truststore-type>JCEKS</truststore-type>
 <truststore-password>password</truststore-password>

<verify-hostname>true</verify-hostname>
 </ssl-config>
-->
...
 </remote>
 </config>

Login for Kerberos and JVM

Your java.login.config and java.security settings look fine.

Include your configuration for Tomcat

You can use setenv.sh config file

$ vi /opt/alfresco/tomcat/bin/setenv.sh

JAVA_OPTS="$JAVA_OPTS -Djava.security.krb5.conf=/etc/krb5.conf"

Browsers

It works fine with IE, just add Alfresco Site (http://gedalfresco.gct.com.tn:8080) to Local Intranet option and mark "Automatically logon with current username and password" flag.

Chrome and Firefox will requiere further configuration: https://docs.alfresco.com/community/concepts/auth-kerberos-clientconfig.html

WARNING: I've included some highlights about Kerberos configuration but probably some paths or names are wrong. Just to include a checkpoint for you in order to validate your installation. Probably you have to find a typo somewhere and it will be done.

Re: Problems on Configuring SSO (Kerberos )against Active Directory

mbedoui — Tue, 13 Mar 2018 07:27:43 GMT

I'm going to check the configuration according to your recommendation , but in parallel with this action I'm looking to know the log file realted to kerberos ,activate log if already disabled and cause of this warning and errors

2018-03-12 17:11:58,375 WARN [org.alfresco.web.app.servlet.NTLMAuthenticationFilter] [http-apr-8080-exec-1] NTLM filter, error resolving CIFS host nameGEDALFRESCOA

Re: Problems on Configuring SSO (Kerberos )against Active Directory

angelborroy — Tue, 13 Mar 2018 08:31:25 GMT

Probably you missed

ntlm.authentication.sso.enabled=false

configuration.

Re: Problems on Configuring SSO (Kerberos )against Active Directory

mbedoui — Tue, 13 Mar 2018 16:58:25 GMT

I would like to thank you for your support and your time , it's works :

2018-03-13 17:41:22,941 DEBUG [org.alfresco.web.app.servlet.KerberosAuthenticationFilter] [http-apr-8080-exec-7] Authentication not required (filter), chaining ...
2018-03-13 17:41:22,948 DEBUG [org.alfresco.web.app.servlet.KerberosAuthenticationFilter] [http-apr-8080-exec-10] Authentication not required (filter), chaining ...
2018-03-13 17:41:22,995 DEBUG [org.alfresco.web.app.servlet.KerberosAuthenticationFilter] [http-apr-8080-exec-1] Found a session user: *****
2018-03-13 17:41:22,997 DEBUG [org.alfresco.web.app.servlet.KerberosAuthenticationFilter] [http-apr-8080-exec-1] Authentication not required (user), chaining ..