topic Re: Problem share services alfresco when sso enabled in Alfresco Forum

Problem share services alfresco when sso enabled

yacinezr — Tue, 23 May 2017 07:48:22 GMT

hello,I have a problem with CIFS configuration, I could successfully activate CIFS but I have a problem with share services when I enable sso authentification.exactly on this ligne of the alfresco-global.properties configurationntlm.authentication.sso.enabled=truewhen I set sso to false, I couldn't

Re: Problem share services alfresco when sso enabled

afaust — Tue, 23 May 2017 08:21:48 GMT

You need to reconfigure most of the Remote endpoints in share-config-custom.xml to use the /wcs base URL and external authentication. One thing that you may have missed there is configuration of the "alfresco-api" endpoint to use external authentication (URL unchanged).

Re: Problem share services alfresco when sso enabled

mehe — Tue, 23 May 2017 08:40:09 GMT

I usually used (if using cifs at all, I prefer connecting via WebDAV/aos over https)

alfresco.authentication.authenticateCIFS=false
ntlm.authentication.authenticateCIFS=false
passthru.authentication.authenticateCIFS=true‍‍‍‍‍‍‍‍‍

so sso is handled via ntlm, but cifs via passthru.

Another thing I sometimes left out in upgrading was the repository URL in share-config-custom.xml

<repository-url>http://myalfresco:Port/alfresco</repository-url>
‍‍‍

Like Axel said, there is a config section (usually commented out) in the sample config for external auth.

Hope it helps....

Martin

Re: Problem share services alfresco when sso enabled

yacinezr — Tue, 23 May 2017 08:51:37 GMT

what I have to do in my case

I had tried this configuration

share-config-custom.xml


<config evaluator="string-compare" condition="Remote">
 <remote>
 <connector>
 <id>alfrescoHeader</id>
 <name>Alfresco Connector</name>
 <description>Connects to an Alfresco instance using userHeader authentication</description>
 <class>org.alfresco.web.site.servlet.SlingshotAlfrescoConnector</class>
 <userHeader>X-Alfresco-Remote-User</userHeader>
 </connector>

<endpoint>
 <id>alfresco</id>
 <name>Alfresco - user access</name>
 <description>Access to Alfresco Repository WebScripts that require user authentication</description>
 <connector-id>alfrescoHeader</connector-id>
 <endpoint-url>http://localhost:8084/alfresco/s</endpoint-url>
 <identity>user</identity>
 <external-auth>true</external-auth>
 </endpoint>
 
 <endpoint>
 <id>alfresco-api</id>
 <parent-id>alfresco</parent-id>
 <name>Alfresco Public API - user access</name>
 <description>Access to Alfresco Repository Public API that require user authentication.
 This makes use of the authentication that is provided by parent 'alfresco' endpoint.</description>
 <connector-id>alfrescoHeader</connector-id>
 <endpoint-url>http://localhost:8084/alfresco/api</endpoint-url>
 <identity>user</identity>
 <external-auth>true</external-auth>
 </endpoint>
 
 <endpoint>
 <id>alfresco-feed</id>
 <parent-id>alfresco</parent-id>
 <name>Alfresco Feed</name>
 <description>Alfresco Feed - supports basic HTTP authentication via the EndPointProxyServlet</description> 
 <connector-id>alfrescoHeader</connector-id> 
 <endpoint-url>http://localhost:8084/alfresco/s</endpoint-url>
 <identity>user</identity>
 <external-auth>true</external-auth>
 </endpoint>
 </remote>
 </config>



alfresco-global.properties



authentication.chain=external1:external,ldap1:ldap,alfrescoNtlm1:alfrescoNtlm

external.authentication.proxyUserName=
external.authentication.enabled=true
external.authentication.defaultAdministratorUserNames=admin
external.authentication.proxyHeader=X-Alfresco-Remote-User


### Ntlm ###
alfresco.authentication.allowGuestLogin=false
alfresco.authentication.authenticateCIFS=false
ntlm.authentication.sso.enabled=true
ntlm.authentication.mapUnknownUserToGuest=false

this box always appear: when I enter the admin and the password, it reappear again.

what should I do?

Re: Problem share services alfresco when sso enabled

mehe — Tue, 23 May 2017 14:39:45 GMT

As I can see you are using the HTTP Header entries, like X-Alfresco-Remote-User

Do you really have an authenticating proxy that's setting these header fields?

Maybe you could describe your setup?

Re: Problem share services alfresco when sso enabled

yacinezr — Wed, 24 May 2017 06:47:23 GMT

normal setup, nothing special. with admin password =admin
I use 'windows 8.1' and 'alfresco-community-installer-201612-win-x64'

I am really don't know X-Alfresco-Remote-User
I followed this [ACE-5682] Share displays the "Alfresco is running without Share Services.See your...." message when external authentica…
but I can't solve the problem

Re: Problem share services alfresco when sso enabled

mehe — Wed, 24 May 2017 13:01:29 GMT

..ok.. External Authentication is relying on an external authentication proxy that sets the X-Alfresco-Remote-User http header - which is not your setup. You should use passthru authentication when connecting to a Windows Domain.

Do you want to synchronize/authenticate against a Windows Active Directory?

Then:

authentication.chain=alfrescoNtlm1:alfrescoNtlm,passthru1:passthru,ldap1:ldap-ad

ntlm.authentication.sso.enable=false
ntlm.authentication.authenticateCIFS=false
#ntlm.authentication.mapUnknownUserToGuest=false

alfresco.authentication.authenticateCIFS=false
#alfresco.authentication.allowGuestLogin=false

passthru.authentication.sso.enabled=false
passthru.authentication.authenticateCIFS=true
passthru.authentication.useLocalServer=false
passthru.authentication.servers=YOUR_DOM\\YOUR_DC
passthru.authentication.defaultAdministratorUserNames=YOUR_ADMIN‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

But maybe I still didn't understand what you want to achieve...

Using alfresco as a single user on your local computer would just work out of the box. You wouldn't have to configure anything. Just use the admin user you created during the install process to login, go to the admin console and create users as needed. These users will be known to alfresco only.