topic Re: External Authentication with Alfresco Community Edition in Alfresco Forum

External Authentication with Alfresco Community Edition

parnold — Tue, 28 Jul 2020 10:25:50 GMT

Hello there,

I need any help I can get by setting up an external authentication with alfresco share.
This will be a longer post explaining what I have tried up until now and what my target setup should look like.

Resources
------------------------

First I read the Alfresco documentation about authentication subsystems and the following chapters to get a grasp how it is configured.
Then I tried to follow this Tutorial as close as I could

Current Test Setup
------------------------

LoadBalancer
- terminates SSL
Webserver (Linux)
- httpd (http on port 80)
  - Reverse Proxy to keycloak and alfresco
  - httpd.conf with CAS configuration from resource 2.
- Keycloak (http on port 8080)
  - CAS client
Application Server (Linux)
- Alfresco 5.2 Tomcat (http on port 8080)
  - share-config-custom.xml configuration from resource 2. and disabled CSRF Token Filter
  - alfresco-global.properties configuration from resource 2.

Current result:

After beeing redirected to Keycloak and logged in there is a 504 Gateway Time-out
Nothing in the Alfresco Tomcat Logs

Instead of Keycloak I also tried using a HTTP Basic Auth in the httpd webserver
The results have been similar dissapointing:

After the Basic Auth dialog of the httpd, where I could authenticate another Basic Auth Popup from Alfresco pops up. This time the credentials are not accepted. When I cancel it I get redirected to the Login Page of "share"

I'd be grateful for any hint in the right direction, alternative working setups e.g. with shibboleth instead of keycloak or nginx instead of httpd

My current config files for reference
---------------------

Re: External Authentication with Alfresco Community Edition

THAUSSIG — Mon, 10 Aug 2020 15:33:04 GMT

I am facing the same issue with Alfresco Community 6.2.x . Anyone can help? Thanks in advance.

Re: External Authentication with Alfresco Community Edition

joe_l3 — Thu, 29 Apr 2021 16:55:08 GMT

Before working on the full stack, I suggest you to try access directly to alfresco share in order to make sure the externalAuth configuration is working. You can do that by using a Chrome header extension like ModHeader (or similar for Firefox). Open ModHeader settings and put this:

X-Alfresco-Remote-User=your_username

and go to http://alfresco_host:8080/share ...you should see the share dashboard page without login. To log more info append this on alfresco log4j.properties:

log4j.logger.org.alfresco.repo.security.authentication.external=DEBUG
log4j.logger.org.alfresco.repo.security.authentication.SimpleAcceptOrRejectAllAuthenticationComponentImpl=DEBUG
log4j.logger.org.alfresco.repo.security.authentication.AbstractChainingAuthenticationService=DEBUG

Re: External Authentication with Alfresco Community Edition

ayatullah — Thu, 23 Sep 2021 03:23:50 GMT

Hello,

i want to add the same functionality but i cannot find the tutorial you mentioned

https://blog.johanet.fr/single-sign-on-with-alfresco-share-and-keycloak/

di you have any other reference or sample code ?

Re: External Authentication with Alfresco Community Edition

LoneStar — Sat, 19 Nov 2022 17:39:40 GMT

Hello,

I'm trying to do the same with ACS 7.2 (installed in docker with alfresco-docker-installer).

I understand that the thing I should do is adding to the JAVA_OPTS settings this:

...
services: 
   alfresco:
...
            JAVA_OPTS : '
...
               -Dauthentication.chain=external1:external,alfrescoNtlm1:alfrescoNtlm
               -Dexternal.authentication.proxyUserName=
               -Dexternal.authentication.enabled=true
               -Dexternal.authentication.defaultAdministratorUserNames=admin
               -Dexternal.authentication.proxyHeader=X-Alfresco-Remote-User
           '
...

Then for a testing I set a header in my browser with ModHeader as "X-Alfresco-Remote-User: <myusername>" and open the Share url for my instance (or /alfresco). But I keep getting the usual login screen as if nothing has changed.

There must be some step that I'm missing..?

Thanks in advance,

Luigi