topic Re: Kerberos ACS 6.2 Community in Alfresco Forum

Kerberos ACS 6.2 Community

maxodoble — Fri, 06 Dec 2019 12:33:32 GMT

Hi,

have a working Installation of ACS 6.1.2 Community with enabled Kerberos SSO.

When trying the same Configuration with ACS 6.2.0 GA, i am getting errors, as soon as i enable Kerberos SSO:

SEVERE: Servlet.service() for servlet [wcapiServlet] in context with path [/alfresco] threw exception
org.alfresco.rest.framework.core.exceptions.NotFoundException: 11060000 /create/alfresco/site-data/extensions/default-persisted-extension.xml was not found
	at org.alfresco.rest.api.PublicApiDeclarativeRegistry.findWebScript(PublicApiDeclarativeRegistry.java:250)
	at org.alfresco.repo.webdav.auth.BaseSSOAuthenticationFilter.doFilter(BaseSSOAuthenticationFilter.java:204)
	at jdk.internal.reflect.GeneratedMethodAccessor457.invoke(Unknown Source)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.base/java.lang.reflect.Method.invoke(Method.java:566)
	at org.alfresco.repo.management.subsystems.ChainingSubsystemProxyFactory$1.invoke(ChainingSubsystemProxyFactory.java:119)
	at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:186)
	at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:212)
	at com.sun.proxy.$Proxy150.doFilter(Unknown Source)
	at org.alfresco.repo.web.filter.beans.BeanProxyFilter.doFilter(BeanProxyFilter.java:89)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
	at org.alfresco.web.app.servlet.WebScriptSSOAuthenticationFilter.doFilter(WebScriptSSOAuthenticationFilter.java:124)
	at jdk.internal.reflect.GeneratedMethodAccessor457.invoke(Unknown Source)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.base/java.lang.reflect.Method.invoke(Method.java:566)
	at org.alfresco.repo.management.subsystems.ChainingSubsystemProxyFactory$1.invoke(ChainingSubsystemProxyFactory.java:119)
	at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:186)
	at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:212)
	at com.sun.proxy.$Proxy150.doFilter(Unknown Source)
	at org.alfresco.repo.web.filter.beans.BeanProxyFilter.doFilter(BeanProxyFilter.java:89)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
	at org.alfresco.web.app.servlet.WebscriptCookieAuthenticationFilter.doFilter(WebscriptCookieAuthenticationFilter.java:77)
	at jdk.internal.reflect.GeneratedMethodAccessor457.invoke(Unknown Source)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.base/java.lang.reflect.Method.invoke(Method.java:566)
	at org.alfresco.repo.management.subsystems.ChainingSubsystemProxyFactory$1.invoke(ChainingSubsystemProxyFactory.java:132)
	at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:186)
	at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:212)
	at com.sun.proxy.$Proxy150.doFilter(Unknown Source)
	at org.alfresco.repo.web.filter.beans.BeanProxyFilter.doFilter(BeanProxyFilter.java:89)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
	at org.alfresco.web.app.servlet.GlobalLocalizationFilter.doFilter(GlobalLocalizationFilter.java:68)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
	at org.alfresco.web.app.servlet.ClearSecurityContextFilter.doFilter(ClearSecurityContextFilter.java:53)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
	at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:199)
	at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96)
	at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:470)
	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:140)
	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:80)
	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:87)
	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:342)
	at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:799)
	at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66)
	at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:861)
	at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1458)
	at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
	at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
	at java.base/java.lang.Thread.run(Thread.java:834)

Dec 06, 2019 1:17:02 PM org.apache.catalina.core.StandardWrapperValve invoke
SEVERE: Servlet.service() for servlet [wcapiServlet] in context with path [/alfresco] threw exception
org.alfresco.rest.framework.core.exceptions.NotFoundException: 11060001 /create/alfresco/site-data/module-deployments/Aikau 1.0.101.19 Config Module.xml was not found
	at org.alfresco.rest.api.PublicApiDeclarativeRegistry.findWebScript(PublicApiDeclarativeRegistry.java:250)
	at org.alfresco.repo.webdav.auth.BaseSSOAuthenticationFilter.doFilter(BaseSSOAuthenticationFilter.java:204)
	at jdk.internal.reflect.GeneratedMethodAccessor457.invoke(Unknown Source)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.base/java.lang.reflect.Method.invoke(Method.java:566)
	at org.alfresco.repo.management.subsystems.ChainingSubsystemProxyFactory$1.invoke(ChainingSubsystemProxyFactory.java:119)
	at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:186)
	at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:212)
	at com.sun.proxy.$Proxy150.doFilter(Unknown Source)
	at org.alfresco.repo.web.filter.beans.BeanProxyFilter.doFilter(BeanProxyFilter.java:89)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
	at org.alfresco.web.app.servlet.WebScriptSSOAuthenticationFilter.doFilter(WebScriptSSOAuthenticationFilter.java:124)
	at jdk.internal.reflect.GeneratedMethodAccessor457.invoke(Unknown Source)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.base/java.lang.reflect.Method.invoke(Method.java:566)
	at org.alfresco.repo.management.subsystems.ChainingSubsystemProxyFactory$1.invoke(ChainingSubsystemProxyFactory.java:119)
	at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:186)
	at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:212)
	at com.sun.proxy.$Proxy150.doFilter(Unknown Source)
	at org.alfresco.repo.web.filter.beans.BeanProxyFilter.doFilter(BeanProxyFilter.java:89)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
	at org.alfresco.web.app.servlet.WebscriptCookieAuthenticationFilter.doFilter(WebscriptCookieAuthenticationFilter.java:77)
	at jdk.internal.reflect.GeneratedMethodAccessor457.invoke(Unknown Source)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.base/java.lang.reflect.Method.invoke(Method.java:566)
	at org.alfresco.repo.management.subsystems.ChainingSubsystemProxyFactory$1.invoke(ChainingSubsystemProxyFactory.java:132)
	at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:186)
	at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:212)
	at com.sun.proxy.$Proxy150.doFilter(Unknown Source)
	at org.alfresco.repo.web.filter.beans.BeanProxyFilter.doFilter(BeanProxyFilter.java:89)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
	at org.alfresco.web.app.servlet.GlobalLocalizationFilter.doFilter(GlobalLocalizationFilter.java:68)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
	at org.alfresco.web.app.servlet.ClearSecurityContextFilter.doFilter(ClearSecurityContextFilter.java:53)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
	at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:199)
	at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96)
	at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:470)
	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:140)
	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:80)
	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:87)
	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:342)
	at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:799)
	at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66)
	at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:861)
	at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1458)
	at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
	at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
	at java.base/java.lang.Thread.run(Thread.java:834)

Does anybody know how i could track down the cause of this problem?

Any obvious hints whats going on here?

Thanks,

Max

Re: Kerberos ACS 6.2 Community

netchaiev — Sat, 28 Dec 2019 00:44:24 GMT

Hello

I'm in the same situation when i try to map webdav folder in Windows (Alfresco AS Community 6.2)

Auth with Kerberos without SSO -> OK

Auth with Kerberos with SSO -> same logs (".... networks was not found")

If someone has a solution ...

Re: Kerberos ACS 6.2 Community

fedorow — Sat, 28 Dec 2019 06:18:59 GMT

Tracing authentication process could help to understand the problem.

https://docs.alfresco.com/6.2/concepts/auth-kerberos-debug.html

Re: Kerberos ACS 6.2 Community

Steph76k — Wed, 11 Mar 2020 11:48:41 GMT

Dear All,

I'm facing a similar issue, could anyone find the solution?

Thanks

Steph

Re: Kerberos ACS 6.2 Community

EddieMay — Thu, 12 Mar 2020 10:44:49 GMT

Hi @Steph76k,

I've asked our engineers if there was any change in Kerberos implementation btn 6.1 & 6.2. I'll report back asap.

Re: Kerberos ACS 6.2 Community

msheremeta — Tue, 31 Mar 2020 09:12:27 GMT

I am getting the above mentioned error on ACS 6.2.0 enterprise with Kerberos authentication.

Additional lines I'm getting in the log after changing Kerberos logging level as fedorow recommends are:

2020-03-31 09:04:13,833  DEBUG [app.servlet.KerberosAuthenticationFilter] [localhost-startStop-1] preRegister called. Server=com.sun.jmx.mbeanserver.JmxMBeanServer@4cc77c2e, name=log4j:logger=org.alfresco.web.app.servlet.KerberosAuthenticationFilter
2020-03-31 09:04:13,844  DEBUG [webdav.auth.KerberosAuthenticationFilter] [localhost-startStop-1] preRegister called. Server=com.sun.jmx.mbeanserver.JmxMBeanServer@4cc77c2e, name=log4j:logger=org.alfresco.repo.webdav.auth.KerberosAuthenticationFilter

Re: Kerberos ACS 6.2 Community

EddieMay — Tue, 31 Mar 2020 14:20:39 GMT

Hi @msheremeta,

What does your share-config-custom.xml configuration look like? Is it setup correctly for Kerberos?

Re: Kerberos ACS 6.2 Community

phivuu-2 — Wed, 03 Jun 2020 02:05:11 GMT

@maxodoble

Did you find any solution to the problem?

Re: Kerberos ACS 6.2 Community

luca_ow — Mon, 12 Oct 2020 10:27:55 GMT

Hi,

same problem for me.

I'm using Alfresco Community 6.2 (201911 GA).

With Kerberos disabled I'm able to mount WebDAV as a Network Drive.

With Kerberos enabled mount doesn't work; the error message is: "The network name cannot be found".

Kerberos seems to be configured correctly: SSO in Chrome and IE works fine.

Note that all settings proposed in https://docs.alfresco.com/6.2/concepts/auth-kerberos-clientconfig.html under the section "Kerberos client configuration for WebDav" has also been applied.

Using Fiddler , with Kerberos enabled, I see many identical redirect:

@fedorow enabling debug logs doesn't print additional informations in Alfresco logs

@EddieMay any good news from Alfresco engineers?

Thanks

Re: Kerberos ACS 6.2 Community

hajop — Wed, 03 Feb 2021 11:16:43 GMT

I just encountered the same Problem.

I also observed, that enabling debug logs doesn't print any additional informations in Alfresco logs.

@EddieMay What did your engineers say?

Re: Kerberos ACS 6.2 Community

jpotts — Sat, 08 May 2021 18:38:09 GMT

I am also seeing this. Did anyone ever resolve it?

Re: Kerberos ACS 6.2 Community

heiko_robert — Fri, 15 Oct 2021 08:24:11 GMT

I just have the same problem after enabling Kerberos on a 6.2 CE. Any hints / solution?

Re: Kerberos ACS 6.2 Community

heiko_robert — Mon, 18 Oct 2021 15:44:45 GMT

Caused by: KrbException: KDC cannot accommodate requested option (13)

is pointing me to Updates to TGT delegation across incoming trusts in Windows Server

Re: Kerberos ACS 6.2 Community

iblanco — Mon, 10 Oct 2022 06:59:54 GMT

Hi Everyone,

Did you finally manage to solve this?

I've been struggling with this for several ours thinking that something very strange was wrong with my config until I saw this post.

Do you know if at least Kerberos SSO is working ok in newer community versions?

Thanks

Re: Kerberos ACS 6.2 Community

cesarista — Mon, 10 Oct 2022 10:53:51 GMT

Hi Igor:

FYI, I did a recent setup (upgraded from Alfresco CE 5.2.g) to Alfresco Community 7.2.0, with Kerberos SSO working properly. Nothing was specially different with respect to the previous version, maybe the security policies config that applies to Java 11.

Kind regards.

--C.

Re: Kerberos ACS 6.2 Community

heiko_robert — Wed, 26 Oct 2022 07:17:47 GMT

It is fixed in a later remote-api version, but there is no ready to go acs-community-packaging version (I know of) including a fixed remote-api/alfresco-community-repo version. Since some organisations don't want to upgrade to 7.x, we build our own acs-community-packaging version 6.2.2 including alfresco-community-repo version 7.199.328 which fixes the Kerberos/SSO webdav and wcs issue.

Alfresco version obfuscation: repo 7.199.328 corresponds to Alfresco release 6.2.2.24