topic Re: ACS 7.3 CE Kerberos SSO not working, always shows login page in Alfresco Forum

ACS 7.3 CE Kerberos SSO not working, always shows login page

rrosell — Thu, 27 Jul 2023 14:03:25 GMT

Hi folks,

I recently installed ACS 7.3.1 on Windows Server 2022, following these instructions:
https://javaworld-abhinav.blogspot.com/2022/05/setup-acs-7-ass-2-and-local-windows.html
- Tomcat 9.0.72
- OpenJDK 11.0.19
- ActiveMQ 5.17.4
- PostgreSQL 15.3
- ASS 2.0.6
- Transform Core-AiO 2.7.1

That works so far, ldap-AD sync is running and I can log in with my AD user.

Then I wanted to configure Kerberos SSO and followed these instructions:
- https://docs.alfresco.com/identity-service/latest/tutorial/sso/
- https://hub.alfresco.com/t5/alfresco-content-services-forum/acs-7-3-kerberos-sso-authentication-for-share-stops-working/td-p/315571
- https://hub.alfresco.com/t5/alfresco-content-services-forum/kerberos-sso-configuration/td-p/304314
-https://docs.alfresco.com/content-services/community/admin/auth-sync/
I also tried different constellations resulting from the pages.

User alfrescosso created, SPN's set, keytab created and distributed, Configs adjusted and so on.

I changed the port from 8080 to 80.

Firefox, Edge (Chromium) and IE are configured accordingly.

Now when I go to http://<server>/share/, the orange login page always appears.

Is there anything else I need to take care of?

Or can someone post working config files (share-config-custom.xml, alfresco-global.properties, java.login.config, ...)?

Thanks

Greetings
Robert

Re: ACS 7.3 CE Kerberos SSO not working, always shows login page

abhinavmishra14 — Thu, 27 Jul 2023 17:49:35 GMT

you may have missed any config or miss configure. Try to revisit the steps and see if you can locate anything.

Also try to see if you find any errors in alfresco.log, share.log and catalina.out.

Re: ACS 7.3 CE Kerberos SSO not working, always shows login page

Sandra09 — Fri, 28 Jul 2023 06:01:55 GMT

You can double-check that the DNS is correctly resolving the hostname of your ACS server. Also, ensure that the hostname used in the SPNs matches the server's actual hostname. Or Enable Kerberos debugging to check if there are any errors or issues with the Kerberos authentication process. You can add the following property to the "alfresco-global.properties" file:

kerberos.authentication.debug=true

Re: ACS 7.3 CE Kerberos SSO not working, always shows login page

rrosell — Fri, 28 Jul 2023 14:27:01 GMT

Hi,

I have solved it in the meantime.
I have reset the whole share-config-custom.xml and started again. I included both <config evaluator="string-compare" condition="Remote"> sections.

After that I got a java error for the Kerberos connection: GSSException: No valid credentials provided (Mechanism level: KDC cannot accommodate requested option (13))

I was able to fix this by changing the AD user for delegation to "Trust the user for delegation to specified services only".
https://stackoverflow.com/questions/72651807/krberror-kdc-cannot-accommodate-requested-option-when-constrained-delegation

Re: ACS 7.3 CE Kerberos SSO not working, always shows login page

carsicko — Wed, 30 Apr 2025 12:39:32 GMT

Great Post! Thanks for sharing great information

Re: ACS 7.3 CE Kerberos SSO not working, always shows login page

Varley — Wed, 30 Apr 2025 12:46:54 GMT

ACS 7.3 CE Kerberos SSO isn't working — it keeps showing the login page instead of signing in automatically. Seems like SSO is being bypassed entirely.