topic Could we make the kerberos users alfrescocifs and alfrescohttp to allow customers to have several alfresco instances (e.g: test, validation and production environments) authenticate against the same AD server in Alfresco Forum

Could we make the kerberos users alfrescocifs and alfrescohttp to allow customers to have several alfresco instances (e.g: test, validation and production environments) authenticate against the same AD server

tanmaysalve — Wed, 16 Aug 2017 11:33:44 GMT

Two Instances:UAT (ip1), PROD(ip2)Steps Performed:First kerberos configuration on UAT - successfulSecond kerberos configuration on PROD - successfulthen,On UAT,when, 1.1.1.1:8080/share, it gives cannot found.alfresco and share application throws exception.Reason:****-**-** **:**:**,925 ERROR [org.al

Re: Could we make the kerberos users alfrescocifs and alfrescohttp to allow customers to have several alfresco instances (e.g: test, validation and production environments) authenticate against the same AD server

afaust — Wed, 16 Aug 2017 13:32:53 GMT

You cannot use Kerberos on an IP-based host. Give UAT a proper domain name and use that to address it, and it should work with Kerberos (provided you set up the SPN in AD as well).

Also, make sure that the user has the SPNs for all the relevant systems, and use the most up-to-date keytab for all systems. Ideally, you would create separate system users in AD for each environment and only have them associated with the SPNs of their environment.

Re: Could we make the kerberos users alfrescocifs and alfrescohttp to allow customers to have several alfresco instances (e.g: test, validation and production environments) authenticate against the same AD server

tanmaysalve — Wed, 16 Aug 2017 14:01:30 GMT

Hi Axel,

Thanks for your reply

We only have two kerberos users alfrescohttp and alfrescocifs currently which worked for one host server (UAT), then we ran the ktpass command which change the principal name with a different host(prod) for the same mentioned kerberos users. It worked for prod but stopped working for UAT (which is obvious)

We are supposed to run several instances of alfresco in our organisation and it would be difficult to manage creation of these users again and again.

Hence I need to know if there is a way out where we can use the same users for several alfresco instances to authenticate against the same AD server though not recommended