Alfresco 5.0a Active Directory sync works but no login possible

[lw3234]

Hi everybody,

I recently set up Alfresco 5.0a in a clean install of Ubuntu 14.04 LTS for testing purpose. I managed to get the active directory integration working as far as all users and groups a specified show up in Alfresco Admin-Tools when logged in with the local admin account.

However, if I try to login with an AD user, which has been, according to the alfresco logs successfully been synced before, I get an error on the login page and nothing more.

Since there is no error in connecting with AD or retrieving users etc. I have no idea where to start searching for the probleme with siging in here.

Thank you for your help !

Cheers,
Ludwig

[mrogers]

Have you turned on authentication?   What are your settings?

[lw3234]

Authentication via AD is turned off; the authentication-chain is set to be alfrescoNtlm1:alfrescoNtlm,passthru1assthru,ldap1:ldap-ad.

Settings are as follows:

alfrescoNtlm1
    ntlm.authentication.sso.enabled=false
    alfresco.authentication.authenticateCIFS=false
passthru1
    ntlm.authentication.sso.enabled=true
    passthru.authentication.authenticateCIFS=true
ldap1
    ldap.authentication.active=false
    ldap.synchronization.active=true


The ubuntu server is a domain member via samba and winbind where authentication on networkshares works fine.

[mrogers]

You have authentication turned off!   So you can't authenticate.

ldap.authentication.active=false   

[lw3234]

Shouldn't be the authentication passed over then via pass-through automatically ?
Iam referring to the alfresco wiki here: https://wiki.alfresco.com/wiki/Alfresco_Authentication_Subsystems#Example_1:_Advanced_AD_Chain


Let me put it another way round. What I want to achieve is:

- AD synchronisation of specific users and groups
- Authentication for alfresco web and CIFS with that users

Since AD authentication cannot be used for CIFS I need to use either pass-through or Kerberos to accomplish that.

Regarding "best practices" what is the better solution ? Using pass-through or kerberos for authentication ?

[mrogers]

AFAIK Kerberos is the only recommended way of authenticating for CIFS.   (I've not investigated in the last year or so) 

So your issue is actually with passthrough authentication.    And you have a fairly tricky config since your server is not on windows so if you post details here someone may be able to help.   

[lw3234]

Just solved this issue. In fact it was just a stupid missconfiguration of the parameter "passthru.authentication.servers=" where the wrong server was set since the file was copied from an older setup.

Thank you for your help !

Cheers