Alfresco 3.3 Community + LDAP +SSO

[alejandrosl]

Hola,

estoy intentando configurar un servidor Alfresco para que los usuarios se identifiquen mediante LDAP, estoy todavía en los primerísimos pasos. El Alfresco es la versión 3.3 Community en Windows XP, descomprimido desde el bundle para Tomcat. Por lo que tengo entendido, debería renombrar el archivo ldap-authentication-context.xml.sample a ldap-authentication-context.xml y hacer ciertas modificaciones en el mismo, así como en el ldap-authentication.properties y el file-servers-custom.xml. El caso es que en las localizaciones donde deberían estar los dos primeros de estos archivos no los encuentro, y de hecho tampoco aparecen en ninguna parte de todo el árbol del directorio Alfresco. ¿Se ha hecho algún cambio y esos archivos ya no existen, o bien es que el bundle no los incluye? En este último caso, ¿cómo podría conseguirlos?

[alejandrosl]

Bien, por lo que he podido averiguar desde la versión 3.2 todos los parámetros de configuración del LDAP se incluyen en el alfresco-global.properties. Añado al mensaje anterior que quiero que el usuario que está logeado en Windows entre directamente en Alfresco sin tener que volver a poner su nombre de usuario y contraseña. Así que he configurado el archivo siguiendo ejemplos que he encontrado en varios hilos de los foros y en blogs (http://www.anotherstrangerme.com/alfresco-integration-with-active-directory/, http://estigmatizados.wordpress.com/2009/08/11/every-dog-has-his-day-alfresco-ldap-tambien/), y también el wiki (http://wiki.alfresco.com/wiki/Alfresco_Authentication_Subsystems). El resultado es que en Firefox me pide nombre de usuario y contraseña, si los introduzco entra correctamente para todos los usuarios del LDAP, aunque no para los propios de Alfresco. Según leí en http://forums.alfresco.com/en/viewtopic.php?f=3&t=25556&p=83152&hilit=ldap+sso#p83152 para saltarse esa petición debo teclear about:config en el Firefox y modificar la propiedad network.automatic-ntlm-auth.trusted-uris para ponerle el valor http://localhost:8080/alfresco. Una vez hecho eso, reiniciado Alfresco y entrado de nuevo en el explorador de Alfresco, obtengo el siguiente error, que es el mismo que consigo si utilizo Internet Explorer:

net.sf.acegisecurity.AuthenticationServiceException: Failed to open passthru auth session 
at org.alfresco.repo.security.authentication.ntlm.NTLMAuthenticationComponentImpl.authenticatePassthru(NTLMAuthenticationComponentImpl.java:783) 
at org.alfresco.repo.security.authentication.ntlm.NTLMAuthenticationComponentImpl.authenticate(NTLMAuthenticationComponentImpl.java:554) 
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) 
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39) 
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25) 
at java.lang.reflect.Method.invoke(Method.java:597) 
at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:307) 
at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:183) 
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:150) 
at org.springframework.transaction.interceptor.TransactionInterceptor.invoke(TransactionInterceptor.java:107) 
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172) 
at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:202) 
at $Proxy192.authenticate(Unknown Source) 
at org.alfresco.repo.webdav.auth.BaseNTLMAuthenticationFilter.processType1(BaseNTLMAuthenticationFilter.java:395) 
at org.alfresco.repo.webdav.auth.BaseNTLMAuthenticationFilter.doFilter(BaseNTLMAuthenticationFilter.java:307) 
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) 
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39) 
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25) 
at java.lang.reflect.Method.invoke(Method.java:597) 
at org.alfresco.repo.management.subsystems.ChainingSubsystemProxyFactory$1.invoke(ChainingSubsystemProxyFactory.java:103) 
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172) 
at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:202) 
at $Proxy197.doFilter(Unknown Source) 
at org.alfresco.repo.web.filter.beans.BeanProxyFilter.doFilter(BeanProxyFilter.java:82) 
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) 
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) 
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233) 
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191) 
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128) 
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) 
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) 
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:286) 
at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:845) 
at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:583) 
at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:447) 
at java.lang.Thread.run(Thread.java:619) 
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Añado el contenido de mi alfresco-global.properties. Alguna idea?

###############################
## Common Alfresco Properties #
###############################

#
# Sample custom content and index data location
#————-
dir.root=C:/Alfresco/alf_data

#
# Sample database connection properties
#————-
db.name=alfresco
db.username=alfresco
db.password=alfresco
db.host=localhost
db.port=3306

#
# External locations
#————-
ooo.exe=C:/Alfresco/OpenOffice/OpenOffice3/program/soffice.exe
ooo.enabled=true
#img.root=C:/Alfresco/ImageMagick-6.6.1-Q16
img.root=C:/Alfresco/ImageMagick
img.exe=C:/Alfresco/ImageMagick/bin/convert.exe
swf.exe=C:/Alfresco/SWFTools/pdf2swf.exe

#
# MySQL connection
#————-
db.driver=org.gjt.mm.mysql.Driver
db.url=jdbc:mysql://localhost:3306/alfresco

#
# PostgreSQL connection (requires postgresql-8.2-504.jdbc3.jar or equivalent)
#
#db.driver=org.postgresql.Driver
#db.url=jdbc:postgresql://localhost:5432/alfresco

#
# Index Recovery Mode
#————-
#index.recovery.mode=AUTO

#
# Outbound Email Configuration
#————-
#mail.host=
#mail.port=25
#mail.username=anonymous
#mail.password=
#mail.encoding=UTF-8
#mail.from.default=alfresco@alfresco.org
#mail.smtp.auth=false

#
# Alfresco Email Service and Email Server
#————-

# Enable/Disable the inbound email service.  The service could be used by processes other than
# the Email Server (e.g. direct RMI access) so this flag is independent of the Email Service.
#————-
#email.inbound.enabled=true

# Email Server properties 
#————-
#email.server.enabled=true
#email.server.port=25
#email.server.domain=alfresco.com
#email.inbound.unknownUser=anonymous

# A comma separated list of email REGEX patterns of allowed senders.
# If there are any values in the list then all sender email addresses
# must match. For example:
#   .*\@alfresco\.com, .*\@alfresco\.org
# Allow anyone:
#————-
#email.server.allowed.senders=.*

#
# The default authentication chain
# To configure external authentication subsystems see:
# http://wiki.alfresco.com/wiki/Alfresco_Authentication_Subsystems
#————-
#authentication.chain=alfrescoNtlm1:alfrescoNtlm
#authentication.chain=alfrescoNtlm1:alfrescoNtlm,ldap1:ldap
authentication.chain=passthru1:passthru,ldap1:ldap,alfrescoNtlm1:alfrescoNtlm

passthru.authentication.useLocalServer=false
passthru.authentication.domain=
passthru.authentication.servers=DOMINIO\\servidor
passthru.authentication.guestAccess=false
passthru.authentication.defaultAdministratorUserNames=
#Timeout value when opening a session to an authentication server, in milliseconds
passthru.authentication.connectTimeout=30000
#Offline server check interval in seconds
passthru.authentication.offlineCheckInterval=300
passthru.authentication.protocolOrder=NetBIOS,TCPIP
passthru.authentication.authenticateCIFS=true
passthru.authentication.authenticateFTP=true

ntlm.authentication.sso.enabled=true
ntlm.authentication.mapUnknownUserToGuest=false

#
# IMAP
#————-
#imap.server.enabled=true
#imap.server.port=143
#imap.server.host=localhost

#
# This properties file brings together the common options for LDAP authentication rather than editing the bean definitions
#

ldap.authentication.active=false
ldap.synchronization.active=true

# How to map the user id entered by the user to that passed through to LDAP
# - simple
# - this must be a DN and would be something like
# CN=%s,DC=company,DC=com
# - digest
# - usually pass through what is entered
# %s
ldap.authentication.userNameFormat=uid=%s,ou=people,dc=servidor,dc=es

# The LDAP context factory to use
ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory

# The URL to connect to the LDAP server
ldap.authentication.java.naming.provider.url=ldap://servidor.es:389

# The authentication mechanism to use
#ldap.authentication.java.naming.security.authentication=DIGEST-MD5
ldap.authentication.java.naming.security.authentication=simple

# The default principal to use (only used for LDAP sync)
ldap.authentication.java.naming.security.principal=cn=usuario,dc=servidor,dc=es
# The password for the default principal (only used for LDAP sync)
ldap.authentication.java.naming.security.credentials=clave

# Escape commas entered by the user at bind time
# Useful when using simple authentication and the CN is part of the DN and contains commas
ldap.authentication.escapeCommasInBind=false

# Escape commas entered by the user when setting the authenticated user
# Useful when using simple authentication and the CN is part of the DN and contains commas, and the escaped \, is
# pulled in as part of an LDAP sync
# If this option is set to true it will break the default home folder provider as space names can not contain \
ldap.authentication.escapeCommasInUid=false

#
# This properties file is used to configure LDAP syncronisation
#

# The LDAP user to connect as to do the export operation.
ldap.synchronization.java.naming.security.principal=cn=usuario,dc=servidor,dc=es

# The password for this user, if required
ldap.synchronization.java.naming.security.credentials=clave

# The timestamp format
ldap.synchronization.timestampFormat=yyyyMMddHHmmss'Z'

# The query to find the people to import
ldap.synchronisation.personQuery=(objectclass=inetOrgPerson)

# The search base of the query to find people to import
ldap.synchronisation.personSearchBase=ou=people,dc=servidor,dc=es
ldap.synchronization.userSearchBase=ou=people,dc=servidor,dc=es

# The attribute name on people objects found in LDAP to use as the uid in Alfresco
ldap.synchronisation.userIdAttributeName=uid

# The attribute on person objects in LDAP to map to the first name property in Alfresco
ldap.synchronisation.userFirstNameAttributeName=givenName

# The attribute on person objects in LDAP to map to the last name property in Alfresco
ldap.synchronisation.userLastNameAttributeName=sn

# The attribute on person objects in LDAP to map to the email property in Alfresco
ldap.synchronisation.userEmailAttributeName=mail

# The attribute on person objects in LDAP to map to the organizational id property in Alfresco
ldap.synchronisation.userOrganizationalIdAttributeName=o

# The default home folder provider to use for people created via LDAP import
ldap.synchronisation.defaultHomeFolderProvider=personalHomeFolderProvider

# The query to find group objects
ldap.synchronisation.groupQuery=(objectclass=groupOfUniqueNames)

# The search base to use to find group objects
ldap.synchronization.groupSearchBase=ou=groups,dc=servidor,dc=es

# The attribute on LDAP group objects to map to the gid property in Alfrecso
ldap.synchronisation.groupIdAttributeName=cn

# The group type in LDAP
ldap.synchronisation.groupType=groupOfUniqueNames

# The person type in LDAP
ldap.synchronisation.personType=inetOrgPerson

# The attribute in LDAP on group objects that defines the DN for its members
ldap.synchronisation.groupMemberAttributeName=uniqueMember

# The cron expression defining when people imports should take place
ldap.synchronisation.import.person.cron=0 */10 * * * ?

# The cron expression defining when group imports should take place
ldap.synchronisation.import.group.cron=0 30 * * * ?

# Should all groups be cleared out at import time?
# - this is safe as groups are not used in Alfresco for other things (unlike person objects which you should never clear out during an import)
# - setting this to true means old group definitions will be tidied up.
ldap.synchronisation.import.group.clearAllChildren=true

#
# URL Generation Parameters (The ${localname} token is replaced by the local server name)
#————-
#alfresco.context=alfresco
#alfresco.host=${localname}
#alfresco.port=8080
#alfresco.protocol=http
#
#share.context=share
#share.host=${localname}
#share.port=8080
#share.protocol=http
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍