Alfresco 3.3 Community + LDAP +SSO

[alejandrosl]

Hola,

estoy intentando configurar un servidor Alfresco para que los usuarios se identifiquen mediante LDAP, estoy todavía en los primerísimos pasos. El Alfresco es la versión 3.3 Community en Windows XP, descomprimido desde el bundle para Tomcat. Por lo que tengo entendido, debería renombrar el archivo ldap-authentication-context.xml.sample a ldap-authentication-context.xml y hacer ciertas modificaciones en el mismo, así como en el ldap-authentication.properties y el file-servers-custom.xml. El caso es que en las localizaciones donde deberían estar los dos primeros de estos archivos no los encuentro, y de hecho tampoco aparecen en ninguna parte de todo el árbol del directorio Alfresco. ¿Se ha hecho algún cambio y esos archivos ya no existen, o bien es que el bundle no los incluye? En este último caso, ¿cómo podría conseguirlos?

[alejandrosl]

Bien, por lo que he podido averiguar desde la versión 3.2 todos los parámetros de configuración del LDAP se incluyen en el alfresco-global.properties. Añado al mensaje anterior que quiero que el usuario que está logeado en Windows entre directamente en Alfresco sin tener que volver a poner su nombre de usuario y contraseña. Así que he configurado el archivo siguiendo ejemplos que he encontrado en varios hilos de los foros y en blogs (http://www.anotherstrangerme.com/alfresco-integration-with-active-directory/, http://estigmatizados.wordpress.com/2009/08/11/every-dog-has-his-day-alfresco-ldap-tambien/), y también el wiki (http://wiki.alfresco.com/wiki/Alfresco_Authentication_Subsystems). El resultado es que en Firefox me pide nombre de usuario y contraseña, si los introduzco entra correctamente para todos los usuarios del LDAP, aunque no para los propios de Alfresco. Según leí en http://forums.alfresco.com/en/viewtopic.php?f=3&t=25556&p=83152&hilit=ldap+sso#p83152 para saltarse esa petición debo teclear about:config en el Firefox y modificar la propiedad network.automatic-ntlm-auth.trusted-uris para ponerle el valor http://localhost:8080/alfresco. Una vez hecho eso, reiniciado Alfresco y entrado de nuevo en el explorador de Alfresco, obtengo el siguiente error, que es el mismo que consigo si utilizo Internet Explorer:

net.sf.acegisecurity.AuthenticationServiceException: Failed to open passthru auth session at org.alfresco.repo.security.authentication.ntlm.NTLMAuthenticationComponentImpl.authenticatePassthru(NTLMAuthenticationComponentImpl.java:783) at org.alfresco.repo.security.authentication.ntlm.NTLMAuthenticationComponentImpl.authenticate(NTLMAuthenticationComponentImpl.java:554) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25) at java.lang.reflect.Method.invoke(Method.java:597) at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:307) at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:183) at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:150) at org.springframework.transaction.interceptor.TransactionInterceptor.invoke(TransactionInterceptor.java:107) at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172) at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:202) at $Proxy192.authenticate(Unknown Source) at org.alfresco.repo.webdav.auth.BaseNTLMAuthenticationFilter.processType1(BaseNTLMAuthenticationFilter.java:395) at org.alfresco.repo.webdav.auth.BaseNTLMAuthenticationFilter.doFilter(BaseNTLMAuthenticationFilter.java:307) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25) at java.lang.reflect.Method.invoke(Method.java:597) at org.alfresco.repo.management.subsystems.ChainingSubsystemProxyFactory$1.invoke(ChainingSubsystemProxyFactory.java:103) at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172) at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:202) at $Proxy197.doFilter(Unknown Source) at org.alfresco.repo.web.filter.beans.BeanProxyFilter.doFilter(BeanProxyFilter.java:82) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:286) at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:845) at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:583) at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:447) at java.lang.Thread.run(Thread.java:619) ‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Añado el contenido de mi alfresco-global.properties. Alguna idea?

################################# Common Alfresco Properties ################################## Sample custom content and index data location#————-dir.root=C:/Alfresco/alf_data## Sample database connection properties#————-db.name=alfrescodb.username=alfrescodb.password=alfrescodb.host=localhostdb.port=3306## External locations#————-ooo.exe=C:/Alfresco/OpenOffice/OpenOffice3/program/soffice.exeooo.enabled=true#img.root=C:/Alfresco/ImageMagick-6.6.1-Q16img.root=C:/Alfresco/ImageMagickimg.exe=C:/Alfresco/ImageMagick/bin/convert.exeswf.exe=C:/Alfresco/SWFTools/pdf2swf.exe## MySQL connection#————-db.driver=org.gjt.mm.mysql.Driverdb.url=jdbc:mysql://localhost:3306/alfresco## PostgreSQL connection (requires postgresql-8.2-504.jdbc3.jar or equivalent)##db.driver=org.postgresql.Driver#db.url=jdbc:postgresql://localhost:5432/alfresco## Index Recovery Mode#————-#index.recovery.mode=AUTO## Outbound Email Configuration#————-#mail.host=#mail.port=25#mail.username=anonymous#mail.password=#mail.encoding=UTF-8#mail.from.default=alfresco@alfresco.org#mail.smtp.auth=false## Alfresco Email Service and Email Server#————-# Enable/Disable the inbound email service.  The service could be used by processes other than# the Email Server (e.g. direct RMI access) so this flag is independent of the Email Service.#————-#email.inbound.enabled=true# Email Server properties #————-#email.server.enabled=true#email.server.port=25#email.server.domain=alfresco.com#email.inbound.unknownUser=anonymous# A comma separated list of email REGEX patterns of allowed senders.# If there are any values in the list then all sender email addresses# must match. For example:#   .*\@alfresco\.com, .*\@alfresco\.org# Allow anyone:#————-#email.server.allowed.senders=.*## The default authentication chain# To configure external authentication subsystems see:# http://wiki.alfresco.com/wiki/Alfresco_Authentication_Subsystems#————-#authentication.chain=alfrescoNtlm1:alfrescoNtlm#authentication.chain=alfrescoNtlm1:alfrescoNtlm,ldap1:ldapauthentication.chain=passthru1:passthru,ldap1:ldap,alfrescoNtlm1:alfrescoNtlmpassthru.authentication.useLocalServer=falsepassthru.authentication.domain=passthru.authentication.servers=DOMINIO\\servidorpassthru.authentication.guestAccess=falsepassthru.authentication.defaultAdministratorUserNames=#Timeout value when opening a session to an authentication server, in millisecondspassthru.authentication.connectTimeout=30000#Offline server check interval in secondspassthru.authentication.offlineCheckInterval=300passthru.authentication.protocolOrder=NetBIOS,TCPIPpassthru.authentication.authenticateCIFS=truepassthru.authentication.authenticateFTP=truentlm.authentication.sso.enabled=truentlm.authentication.mapUnknownUserToGuest=false## IMAP#————-#imap.server.enabled=true#imap.server.port=143#imap.server.host=localhost## This properties file brings together the common options for LDAP authentication rather than editing the bean definitions#ldap.authentication.active=falseldap.synchronization.active=true# How to map the user id entered by the user to that passed through to LDAP# - simple# - this must be a DN and would be something like# CN=%s,DC=company,DC=com# - digest# - usually pass through what is entered# %sldap.authentication.userNameFormat=uid=%s,ou=people,dc=servidor,dc=es# The LDAP context factory to useldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory# The URL to connect to the LDAP serverldap.authentication.java.naming.provider.url=ldap://servidor.es:389# The authentication mechanism to use#ldap.authentication.java.naming.security.authentication=DIGEST-MD5ldap.authentication.java.naming.security.authentication=simple# The default principal to use (only used for LDAP sync)ldap.authentication.java.naming.security.principal=cn=usuario,dc=servidor,dc=es# The password for the default principal (only used for LDAP sync)ldap.authentication.java.naming.security.credentials=clave# Escape commas entered by the user at bind time# Useful when using simple authentication and the CN is part of the DN and contains commasldap.authentication.escapeCommasInBind=false# Escape commas entered by the user when setting the authenticated user# Useful when using simple authentication and the CN is part of the DN and contains commas, and the escaped \, is# pulled in as part of an LDAP sync# If this option is set to true it will break the default home folder provider as space names can not contain \ldap.authentication.escapeCommasInUid=false## This properties file is used to configure LDAP syncronisation## The LDAP user to connect as to do the export operation.ldap.synchronization.java.naming.security.principal=cn=usuario,dc=servidor,dc=es# The password for this user, if requiredldap.synchronization.java.naming.security.credentials=clave# The timestamp formatldap.synchronization.timestampFormat=yyyyMMddHHmmss'Z'# The query to find the people to importldap.synchronisation.personQuery=(objectclass=inetOrgPerson)# The search base of the query to find people to importldap.synchronisation.personSearchBase=ou=people,dc=servidor,dc=esldap.synchronization.userSearchBase=ou=people,dc=servidor,dc=es# The attribute name on people objects found in LDAP to use as the uid in Alfrescoldap.synchronisation.userIdAttributeName=uid# The attribute on person objects in LDAP to map to the first name property in Alfrescoldap.synchronisation.userFirstNameAttributeName=givenName# The attribute on person objects in LDAP to map to the last name property in Alfrescoldap.synchronisation.userLastNameAttributeName=sn# The attribute on person objects in LDAP to map to the email property in Alfrescoldap.synchronisation.userEmailAttributeName=mail# The attribute on person objects in LDAP to map to the organizational id property in Alfrescoldap.synchronisation.userOrganizationalIdAttributeName=o# The default home folder provider to use for people created via LDAP importldap.synchronisation.defaultHomeFolderProvider=personalHomeFolderProvider# The query to find group objectsldap.synchronisation.groupQuery=(objectclass=groupOfUniqueNames)# The search base to use to find group objectsldap.synchronization.groupSearchBase=ou=groups,dc=servidor,dc=es# The attribute on LDAP group objects to map to the gid property in Alfrecsoldap.synchronisation.groupIdAttributeName=cn# The group type in LDAPldap.synchronisation.groupType=groupOfUniqueNames# The person type in LDAPldap.synchronisation.personType=inetOrgPerson# The attribute in LDAP on group objects that defines the DN for its membersldap.synchronisation.groupMemberAttributeName=uniqueMember# The cron expression defining when people imports should take placeldap.synchronisation.import.person.cron=0 */10 * * * ?# The cron expression defining when group imports should take placeldap.synchronisation.import.group.cron=0 30 * * * ?# Should all groups be cleared out at import time?# - this is safe as groups are not used in Alfresco for other things (unlike person objects which you should never clear out during an import)# - setting this to true means old group definitions will be tidied up.ldap.synchronisation.import.group.clearAllChildren=true## URL Generation Parameters (The ${localname} token is replaced by the local server name)#————-#alfresco.context=alfresco#alfresco.host=${localname}#alfresco.port=8080#alfresco.protocol=http##share.context=share#share.host=${localname}#share.port=8080#share.protocol=http‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍