Active Direcory & Alfresco

[adnan_douglas]

Dears,

Can anyone help me to configure Alfresco authentication to use Active Directory? I need the steps for the configuration.
Please Advice.

Regards,
Adnan Douglas

[dward]

I would suggest an authentication chain containing the passthru subsystem for authentication and the ldap-ad subsystem for synchronization. You will get NTLM SSO and CIFS authentication against the domain server by default.

Just set the following in alfresco-global.properties

authentication.chain=passthru1assthru,ldap1:ldap-ad
ldap.authentication.active=false
passthru.authentication.domain=# Intentionally left blank
passthru.authentication.servers=DOMAIN\\domaincontroller.com,domaincontroller.com
passthru.authentication.defaultAdministratorUserNames=Administrator
ldap.authentication.java.naming.provider.url=ldap://domaincontroller.com:389
ldap.synchronization.java.naming.security.principal=alfresco@domain
ldap.synchronization.java.naming.security.credentials=secret
ldap.synchronization.groupSearchBase=ou=Security Groups,ou=Alfresco,dc=domain
ldap.synchronization.userSearchBase=ou=User Accounts,ou=Alfresco,dc=domain

I would recommend taking a v3.3 nightly build or building from HEAD, as a number of improvements have been made since the v3.2 Community release.

See http://wiki.alfresco.com/wiki/Alfresco_Authentication_Subsystems for a guide to all these parameters and their meanings.

[luisg]

Hi dward and thanks for your post.

I configured my alfresco with your tips and worked fine.
One more question, if I want to use CIFS I need to add alfrescoNTLM1:alfrescoNTLM to authentication.chain in alfresco-global.properties? I need to change anything in file-servers.properties? I'm asking this because I'm getting:

ERROR [org.alfresco.fileserver] Failed to get local domain/workgroup name, using default of WORKGROUP
ERROR [org.alfresco.fileserver] (This may be due to firewall settings or incorrect <broadcast> setting)
‍‍‍‍

One more time, thanks. Waiting for an answer…

Luis

[dward]

No. Like I said

You will get NTLM SSO and CIFS authentication against the domain server by default.

When running on Linux, or with the Windows native code disabled, you will need to tell the CIFS server your domain name. Try this in alfresco-global.properties

cifs.domain=YOURDOMAIN

[adnan_douglas]

I did the below config but once i try to authenticate I received the following error:
"The remote server may be unavailable or your authentication details have not been recognized."

Please advice and help,
I need to see the authentication log to determine the problem.

[dward]

What do you see in alfresco.log?

[luisg]

ok

Now I dont have the erros. But I tried to test with:

smbclient \\\\localname\\alfresco -U user_from_ad
‍‍‍

and get a 'session setup failed: NT_STATUS_LOGON_FAILURE'

I also tried smbclient \\\\localnameA\\alfresco -U user_from_ad and get Connection to localnameA failed (Error NT_STATUS_BAD_NETWORK_NAME)

What is missing?

[dward]

The Alfresco share has a capital A.

Try with and without domain prefixes on the user name, e.g. -U 'DOMAIN\user'

[luisg]

It's not workin  :shock:

my machine name is alfresco
my machine user is alfresco
the user in Active directory is alfresco
my domain is test.pt

So, to try the CIFS I did:
smbclient \\\\alfrescoA\\alfresco -U alfresco
and I get Connection to alfrescoA failed (Error NT_STATUS_BAD_NETWORK_NAME)

with:
smbclient \\\\alfrescoA\\alfresco -U test.pt\alfresco
I get: Connection to alfrescoA failed (Error NT_STATUS_BAD_NETWORK_NAME)

I think he cant find the server. If I do:
smbclient \\\\alfresco\\alfresco -U alfresco
he ask me for a password, but not the local machine pass or the AD pass works and I get allways:
session setup failed: NT_STATUS_LOGON_FAILURE

wtf?!

[dward]

Please do not swear. I told you the share name has a capital A. And you need to escape or quote backslashes.

Try

smbclient \\\\alfrescoA\\Alfresco -U alfresco
smbclient \\\\alfrescoA\\Alfresco -U test.pt\\alfresco
smbclient \\\\alfresco\\Alfresco -U alfresco