topic Re: Cannot login anymore on Alfresco in Alfresco Forum

Cannot login anymore on Alfresco

marius_dumitrac — Wed, 10 Jul 2019 13:38:14 GMT

Hi guys,I have the following problem with my alfresco instance: the login page in alfresco returns the following messageYour authentication details have not been recognized or Alfresco may not be available at this time.The alfresco installation has the following details:1. CentOS 6 (up to date) 2. P

Re: Cannot login anymore on Alfresco

abhinavmishra14 — Wed, 10 Jul 2019 14:51:39 GMT

Could you see any errors in alfresco.log, share.log and catalina.out ?

Can you also try <host>:<port>/alfresco/service/api/login?u=<userName>&pw=<password> api call to see if you are getting response from repository

Re: Cannot login anymore on Alfresco

marius_dumitrac — Wed, 10 Jul 2019 15:09:56 GMT

Hi Abhinav,

No error in the logs (are attached to the post).

The response from the repository is this

<response>
<status>
<code>403</code>
<name>Forbidden</name>
<description> Server understood the request but refused to fulfill it. </description>
</status>
<message>06100727 Login failed</message>
<exception/>
<callstack> </callstack>
<server>Community v5.0.0 (d r99759-b2) schema 8,022</server>
<time>Jul 10, 2019 6:01:28 PM</time>
</response>

I think it's ok (I don't know the initial admin password, and password of admin account configured in AD is not accepted.)

Also I don't think there is a problem with the AD connection, the sync job is working fine - see below the log entries

2019-07-10 17:45:00,105 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-9] Synchronizing users and groups with user registry 'ldap1'
2019-07-10 17:45:00,106 WARN [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-9] Full synchronization with user registry 'ldap1'
2019-07-10 17:45:00,106 WARN [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-9] Some users and groups previously created by synchronization with this user registry may be removed.
2019-07-10 17:45:00,147 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-9] Retrieving all groups from user registry 'ldap1'
2019-07-10 17:45:00,152 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-9] Synchronization,Category=directory,id1=ldap1,id2=1 Group Analysis: Commencing batch of 0 entries
2019-07-10 17:45:00,152 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-9] Synchronization,Category=directory,id1=ldap1,id2=1 Group Analysis: Completed batch of 0 entries
2019-07-10 17:45:00,185 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-9] Retrieving users changed since Jul 10, 2019 11:05:30 AM from user registry 'ldap1'
2019-07-10 17:45:00,188 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-9] Synchronization,Category=directory,id1=ldap1,id2=6 User Creation and Association: Commencing batch of 1 entries
2019-07-10 17:45:00,521 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-9] Synchronization,Category=directory,id1=ldap1,id2=6 User Creation and Association: Processed 1 entries out of 1. 100% complete. Rate: 3 per second. 0 failures detected.
2019-07-10 17:45:00,521 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-9] Synchronization,Category=directory,id1=ldap1,id2=6 User Creation and Association: Completed batch of 1 entries
2019-07-10 17:45:00,531 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-9] Finished synchronizing users and groups with user registry 'ldap1'
2019-07-10 17:45:00,531 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-9] 1 user(s) and 0 group(s) processed

Re: Cannot login anymore on Alfresco

abhinavmishra14 — Wed, 10 Jul 2019 15:17:49 GMT

OOTB Default admin account should still work. The default user name is: admin and default password: admin

Repo auth api : http://127.0.0.1:8080/alfresco/service/api/login?u=admin&pw=admin

This should return alf_ticket if login is successful. The default admin password is also part of tomcat/shared/classes/alfresco-global.properties file. Its MD4 encrypted. You can decrypt it if required. but in general admin:admin is the default user name and password. Give it a try.

Re: Cannot login anymore on Alfresco

marius_dumitrac — Wed, 10 Jul 2019 15:35:45 GMT

I've tried and the same response - Login failed .

in catalina.out i got this line:

2019-07-10 19:02:26,347 INFO [web.site.EditionInterceptor] [ajp-apr-8009-exec-3] Unable to retrieve License information from Alfresco: 401

Also I've modified the alfresco-global.properties file to use de default authentication (authentication.chain=alfrescoNtlm1:alfrescoNtlm) with the same result - login failed.

But this time the licence was retrieved successfully

2019-07-10 19:11:26,302 INFO [web.site.EditionInterceptor] [ajp-apr-8009-exec-4] Successfully retrieved license information from Alfresco.

Any ideas?

Re: Cannot login anymore on Alfresco

sp2 — Thu, 11 Jul 2019 04:36:04 GMT

Check this url : http://127.0.0.1:8080/alfresco.

If it is not working that means your repo is not started.

Re: Cannot login anymore on Alfresco

marius_dumitrac — Thu, 11 Jul 2019 07:48:36 GMT

Hi Sanjay,

The repo is running (I mean the url is accessible). But I cannot login to the alfresco console. I've reset the admin password and no success either.

Re: Cannot login anymore on Alfresco

fedorow — Thu, 11 Jul 2019 11:35:46 GMT

It looks like share cant connect to alfresco. First of all check connections.

Second give us to see configuration of Authentication subsystem and authentication chain. I can't see initialization of alfrescoNtlm subsystem, so you couldn't login by native Alfresco user 'admin'.

Re: Cannot login anymore on Alfresco

heiko_robert — Thu, 11 Jul 2019 11:46:01 GMT

your logs look OK. Do you have the alfresco internal auth system in your authentication chain?

e.g.

authentication.chain=ldap-ad1:ldap-ad,alfrescoNtlm1:alfrescoNtlm
‍‍‍

you could set another internal user you know the password of as admin in your alfresco-global.properties - e.g. user test:

alfresco_user_store.adminusername=test‍‍

you write an well known password MD4 hash directly into the database. If you decide to change the password in the db you need to restart alfresco.

e.g. to change the admin password to 'admin':

echo -n "admin" | openssl md4 | awk '{print $2}'
f9d4049dd6a4dc35d40e5265954b2a46‍‍‍‍

check https://docs.alfresco.com/community/concepts/admin-password.html for details

EDIT: removed SQL and added link to documentation

Re: Cannot login anymore on Alfresco

marius_dumitrac — Thu, 11 Jul 2019 12:18:01 GMT

Hi guys,

A little success - I've managed to log in (both in alfresco console and share) with the admin user and pass set up in ldap.

I had to change the below line from false to true:

ldap.authentication.active=false -> ldap.authentication.active=true

But with the rest of the users I get the same error message.

Here is the Authentication settings from alfresco-global.properties:

### Authentication chains
authentication.chain=passthru1assthru,ldap1:ldap-ad
#ntlm.authentication.sso.enabled=false
#ntlm.authentication.authenticateCIFS=false
#alfresco.authentication.authenticateCIFS=false
#alfresco.authentication.allowGuestLogin=false
### Passthru settings
passthru.authentication.sso.enabled=false
passthru.authentication.allowGuestLogin=false
passthru.authentication.authenticateFTP=false
passthru.authentication.servers=SERVER_NAME\\192.168.1.254,192.168.1.254
passthru.authentication.domain=
passthru.authentication.guestAccess=false
passthru.authentication.defaultAdministratorUserNames=admin
passthru.authentication.connectTimeout=5000
passthru.authentication.offlineCheckInterval=300
passthru.authentication.protocolOrder=TCPIP
passthru.authentication.authenticateCIFS=true
ldap.authentication.active=true
ldap.authentication.java.naming.security.authentication=simple
ldap.authentication.java.naming.provider.url=ldap://192.168.1.254:389
ldap.authentication.userNameFormat=cn\=%s,ou\=users,dc\=domain_name,dc\=intern
ldap.authentication.defaultAdministratorUsernNames=admin
ldap.authentication.java.naming.security.principal=admin@domain
ldap.authentication.java.naming.security.credentials=12345678
ldap.synchronization.active=true
ldap.synchronization.java.naming.security.principal=admin@doman
ldap.synchronization.java.naming.security.credentials=12345678
ldap.synchronization.queryBatchSize=1000
ldap.synchronization.userSearchBase=ou\=users,dc\=domain,dc\=intern
ldap.synchronization.groupSearchBase=ou\=users,dc\=domain,dc\=intern
ldap.synchronization.modifyTimestampAttributeName=modifyTimestamp
ldap.synchronization.timestampFormat=yyyyMMddHHmmss'.0Z'
ldap.synchronization.userIdAttributeName=sAMAccountName
ldap.synchronization.userFirstNameAttributeName=givenName
ldap.synchronization.userLastNameAttributeName=sn
ldap.synchronization.userEmailAttributeName=mail
ldap.synchronization.groupIdAttributeName=cn
synchronization.synchronizeChangesOnly=true
synchronization.import.cron=0 0/15 * * * ?

Re: Cannot login anymore on Alfresco

marius_dumitrac — Thu, 11 Jul 2019 13:08:24 GMT

I think the problem is with the AD server - I've stoped the AD server and got the same error at login. Start again the AD server and the admin login works.

I've checked the ldap user format used to retrieve users and it seems ok (the same format from the alfresco-global.properties file).

Re: Cannot login anymore on Alfresco

heiko_robert — Thu, 11 Jul 2019 13:31:46 GMT

You configured your Alfresco with passthru which is no longer supported and not a good option anyway. You should switch to kerberos. I bet a windows server update killed your passthru authentication with the latest windows update. By enableing ldap authentication you will be able to authenticate users as defined in your ldap config which is:

SearchBase=ou\=users,dc\=domain,dc\=intern

but only the ones sitting directly in users,dc\=domain_name,dc\=intern

please check the ldap-ad properties example which fit better for AD and/or read LDAP configuration properties | Alfresco Documentation

Cesar also posted link to a blog in another post: Best Practices for Using Active Directory with Alfresco which may help you to get the right track. Do you also use CIFS? If yes you also need to configure kerberos authentication on top.

Additionally you should add alfrescoNtlm to your chain as mentioned before since admin and guest are created in the internal store.

Re: Cannot login anymore on Alfresco

marius_dumitrac — Thu, 11 Jul 2019 15:35:14 GMT

Hi Robert

You are right, the problem appeared after a windows update.

I've taken out the passthru settings and CIFS ones in the config file and restarted alfresco, but the same problem - admin account can login, the rest of the users not (i get the same error message Your authentication details have not been recognized or Alfresco may not be available at this time.).

Do I need to setup kerberos for the login to work properly for the other users? I thought to leave this out for now.

Here is the updated settings file (red line is added as Caesar's post recommends)

### Authentication chains
authentication.chain=ldap1:ldap-ad
ldap.authentication.active=true
ldap.authentication.java.naming.security.authentication=simple
ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory
ldap.authentication.java.naming.provider.url=ldap://192.168.19.254:389
ldap.authentication.userNameFormat=cn\=%s,ou\=users,dc\=domain,dc\=intern
ldap.authentication.defaultAdministratorUsernNames=admin
ldap.authentication.java.naming.security.principal=admin@domain
ldap.authentication.java.naming.security.credentials=12345678
ldap.synchronization.active=true
ldap.synchronization.java.naming.security.principal=admin@domain
ldap.synchronization.java.naming.security.credentials=12345678
ldap.synchronization.queryBatchSize=1000
ldap.synchronization.userSearchBase=ou\=users,dc\=domain,dc\=intern
ldap.synchronization.groupSearchBase=ou\=users,dc\=domain,dc\=intern
ldap.synchronization.modifyTimestampAttributeName=modifyTimestamp
ldap.synchronization.timestampFormat=yyyyMMddHHmmss'.0Z'
ldap.synchronization.userIdAttributeName=sAMAccountName
ldap.synchronization.userFirstNameAttributeName=givenName
ldap.synchronization.userLastNameAttributeName=sn
ldap.synchronization.userEmailAttributeName=mail
ldap.synchronization.groupIdAttributeName=cn
synchronization.synchronizeChangesOnly=true
synchronization.import.cron=0 0/15 * * * ?

Re: Cannot login anymore on Alfresco

heiko_robert — Thu, 11 Jul 2019 15:42:04 GMT

your ldap config is not correct. Please fix that following the docs I linked. At least your userNameFormat will expect all the users in ou=users,dc=domain,dc=intern.

Re: Cannot login anymore on Alfresco

marius_dumitrac — Fri, 12 Jul 2019 10:32:57 GMT

Hi Robert,

Thanks for help. I've modified the ldap settings as you recommended and now it's up&running.

Re: Cannot login anymore on Alfresco

nilesh — Thu, 10 Aug 2023 10:28:08 GMT

Hello Expert,
Can anyone please help me? trying form last 3 days but had no luck,
alfresco not allowed to log in any user, using community version ( 5.2.g 2001707)

all Subsystems are not starting

2023-08-10 13:49:40,985 INFO [org.alfresco.repo.management.subsystems.ChildApplicationContextFactory] [localhost-startStop-1] Stopping 'Replication' subsystem, ID: [Replication, default]
2023-08-10 13:49:40,985 INFO [org.alfresco.repo.management.subsystems.ChildApplicationContextFactory] [localhost-startStop-1] Stopped 'Replication' subsystem, ID: [Replication, default]

and I'm using alfreco native authentication method default one.

@heiko_robert wrote:
your ldap config is not correct. Please fix that following the docs I linked. At least your userNameFormat will expect all the users in ou=users,dc=domain,dc=intern.