topic Re: Kerberos SSO with ADF in Alfresco Forum

Kerberos SSO with ADF

ivanovpavel1983 — Fri, 08 Jun 2018 11:14:23 GMT

Hello.Has anyone got an example of using SSO authentication with Alfresco Development Framework?In share and alfresco webdav we use this functionality.Thanks!

Re: Kerberos SSO with ADF

eugenio_romano — Fri, 08 Jun 2018 12:59:31 GMT

With Kerberos you don't need to log in, so I guess you need to remove or change the authguard in the router

Re: Kerberos SSO with ADF

ivanovpavel1983 — Fri, 08 Jun 2018 13:25:35 GMT

No, this does not work. And AuthGuard (https://issues.alfresco.com/jira/browse/ADF-2435) doesn't work...

Re: Kerberos SSO with ADF

eugenio_romano — Fri, 08 Jun 2018 13:38:20 GMT

DId you get a look to this issue ADF on SSO enabled ACS with my suggestions they where able to make it works

Re: Kerberos SSO with ADF

ivanovpavel1983 — Fri, 08 Jun 2018 13:44:40 GMT

Yes, but in this case, if you delete the old ticket from browser, there will be a redirect to login page.

This is obviously not SSO ))

Re: Kerberos SSO with ADF

eugenio_romano — Fri, 08 Jun 2018 13:50:38 GMT

Is the ADF authGuard that redirect you to the login page, if you don't have it there will be no redirect.

1)You can write your own authguard that implement your logic

2) you can add a listener in the main app that if receive 401, because the ticket is deleted, redirect you where is needed

this.alfrescoApiService.getInstance().on('unauthorized', (error) => {
        this.router.navigate(['/navigate-where-you-need']);
    }
});

Re: Kerberos SSO with ADF

ivanovpavel1983 — Fri, 08 Jun 2018 14:00:49 GMT

"if you don't have it there will be no redirect" - in this case will be an error 401

The application should receive a new ticket, but it doesn't have it.

Re: Kerberos SSO with ADF

eugenio_romano — Fri, 08 Jun 2018 15:44:37 GMT

Honestly, I am a bit confused, if you are using kerberos the new ticket should not be automatically provided?

The KDC issues a (TGT) if the TGT expires at some it should be transparently renewed by the user's session manager while they are logged in. How do you delete the ticket from the browser?

Re: Kerberos SSO with ADF

ivanovpavel1983 — Sat, 09 Jun 2018 14:03:44 GMT

We have enabled logging, and have this error:

Any ideas?

Re: Kerberos SSO with ADF

ivanovpavel1983 — Sat, 09 Jun 2018 14:12:27 GMT

And this log is from share:

It's ok.